CVE-2018-3295

Description

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is Prior to 5.2.20. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).

Affected products

Vendor	Product	Affected	Fixed
Oracle	VM VirtualBox	unspecified – < 5.2.20	5.2.20

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 18.04 LTS	virtualbox	No fix yet	—
Ubuntu 16.04 LTS	virtualbox	No fix yet	—

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Leap 15.1	virtualbox	6.0.10-lp151.2.6.1	openSUSE-SU-2019:1814-1
openSUSE Leap 15.0	virtualbox	6.0.10-lp151.2.6.1	openSUSE-SU-2019:1814-1

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 2 repositories

jeongzero8732/cve-2018-3295 ★ 0 · Oct 25, 2020
ndureiss/e1000_vulnerability_exploit ★ 0 · Feb 11, 2019

Exploitation of VirtualBox vulnerability (https://nvd.nist.gov/vuln/detail/CVE-2018-3295)

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 1

openSUSE-SU-2019:1814-1 Security update for virtualbox SUSE / openSUSE Security Updates · Feb 4, 2026

References

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
1041887 vdb-entry
105619 vdb-entry
openSUSE-SU-2019:1814 vendor-advisory

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected i…