CVE-2018-2698

🗓️ 18 Jan 2018 02:00:00Reported by oracleType

cve🔗 web.nvd.nist.gov👁 138 Views🌐 WEB

Vulnerability in Oracle VM VirtualBox can lead to takeove

Reporter	Title	Published	Views	Family All 39
zdt	Oracle VirtualBox < 5.1.30 / < 5.2-rc1 - Guest to Host Escape Vulnerability	25 Jan 201800:00	–	zdt
GithubExploit	Exploit for Incorrect Type Conversion or Cast in Redhat Enterprise_Linux_Desktop	16 Jan 201913:15	–	githubexploit
BDU FSTEC	The vulnerability of the Core component of the Oracle VM VirtualBox allows a malicious attacker from the guest operating system to execute certain commands or copy data from the host operating system.	2 Feb 201800:00	–	bdu_fstec
Circl	CVE-2018-2698	28 Jan 201818:28	–	circl
CNVD	Oracle VM VirtualBox Elevation of Privilege Vulnerability (CNVD-2018-02020)	18 Jan 201800:00	–	cnvd
Cvelist	CVE-2018-2698	18 Jan 201802:00	–	cvelist
Debian CVE	CVE-2018-2698	18 Jan 201802:00	–	debiancve
Exploit DB	Oracle VirtualBox < 5.1.30 / < 5.2-rc1 - Guest to Host Escape	24 Jan 201800:00	–	exploitdb
EUVD	EUVD-2018-14553	7 Oct 202500:30	–	euvd
exploitpack	Oracle VirtualBox 5.1.30 5.2-rc1 - Guest to Host Escape	24 Jan 201800:00	–	exploitpack

NVD

Vulners

Node

oracle vm_virtualboxRange5.1.0–5.1.32

oracle vm_virtualboxRange5.2.0–5.2.6

[
  {
    "product": "VM VirtualBox",
    "vendor": "Oracle Corporation",
    "versions": [
      {
        "lessThan": "5.1.32",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "5.2.6",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
securityfocus	www.securityfocus.com/bid/102688
oracle	www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
exploit-db	www.exploit-db.com/exploits/43878/
securitytracker	www.securitytracker.com/id/1040202

Parameter	Position	Path	Description
PwnRequest.type	binary	/dev/vboxpwn	Arbitrary read/write in VRAM via VBOXVDMACMD_DMA_BPB_TRANSFER where guest-controlled Src.offVramBuf and Dst.offVramBuf offsets are added to VRAM without verification, enabling memcpy(VRAM+X, VRAM+Y, Z).
PwnRequest.size	binary	/dev/vboxpwn	Arbitrary read/write in VRAM via VBOXVDMACMD_DMA_BPB_TRANSFER where guest-controlled Src.offVramBuf and Dst.offVramBuf offsets are added to VRAM without verification, enabling memcpy(VRAM+X, VRAM+Y, Z).
PwnRequest.offset	binary	/dev/vboxpwn	Arbitrary read/write in VRAM via VBOXVDMACMD_DMA_BPB_TRANSFER where guest-controlled Src.offVramBuf and Dst.offVramBuf offsets are added to VRAM without verification, enabling memcpy(VRAM+X, VRAM+Y, Z).
PwnRequest.data	binary	/dev/vboxpwn	Arbitrary read/write in VRAM via VBOXVDMACMD_DMA_BPB_TRANSFER where guest-controlled Src.offVramBuf and Dst.offVramBuf offsets are added to VRAM without verification, enabling memcpy(VRAM+X, VRAM+Y, Z).
VBOXVDMACMD_DMA_BPB_TRANSFER.cbTransferSize	binary	/dev/vboxpwn	Arbitrary read/write in VRAM via VBOXVDMACMD_DMA_BPB_TRANSFER where guest-controlled Src.offVramBuf and Dst.offVramBuf offsets are added to VRAM without verification, enabling memcpy(VRAM+X, VRAM+Y, Z).
VBOXVDMACMD_DMA_BPB_TRANSFER.Src.offVramBuf	binary	/dev/vboxpwn	Arbitrary read/write in VRAM via VBOXVDMACMD_DMA_BPB_TRANSFER where guest-controlled Src.offVramBuf and Dst.offVramBuf offsets are added to VRAM without verification, enabling memcpy(VRAM+X, VRAM+Y, Z).
VBOXVDMACMD_DMA_BPB_TRANSFER.Dst.offVramBuf	binary	/dev/vboxpwn	Arbitrary read/write in VRAM via VBOXVDMACMD_DMA_BPB_TRANSFER where guest-controlled Src.offVramBuf and Dst.offVramBuf offsets are added to VRAM without verification, enabling memcpy(VRAM+X, VRAM+Y, Z).
PwnRequest.type	binary	/dev/vboxpwn	Arbitrary read/write in VRAM via VBOXVDMACMD_DMA_PRESENT_BLT where guest-controlled offSrc/offDst cause memcpy between VRAM addresses without proper bounds checks, leading to out-of-bounds reads/writes.
PwnRequest.size	binary	/dev/vboxpwn	Arbitrary read/write in VRAM via VBOXVDMACMD_DMA_PRESENT_BLT where guest-controlled offSrc/offDst cause memcpy between VRAM addresses without proper bounds checks, leading to out-of-bounds reads/writes.
PwnRequest.offset	binary	/dev/vboxpwn	Arbitrary read/write in VRAM via VBOXVDMACMD_DMA_PRESENT_BLT where guest-controlled offSrc/offDst cause memcpy between VRAM addresses without proper bounds checks, leading to out-of-bounds reads/writes.

17 Jun 2026 01:56Current

6.1Medium risk

Vulners AI Score6.1

CVSS 24.1

CVSS 38.8

EPSS0.01658

SSVC