VMware ESXi 6.5 without patch ESXi650-201703410-SG and 5.5 without patch ESXi550-201703401-SG; Workstation Pro / Player 12.x prior to 12.5.5; and Fusion Pro / Fusion 8.x prior to 8.5.6 have a Heap Buffer Overflow in SVGA. This issue may allow a guest to execute code on the host.

The version of the remote VMware ESXi 5.5 host is prior to build 5230635. It is, therefore, affected by multiple vulnerabilities:

  - VMware ESXi 5.5 without patch ESXi550-201703401-SG has a Heap Buffer Overflow in SVGA. This issue may     allow a guest to execute code on the host. (CVE-2017-4902)

  - VMware ESXi 5.5 without patch ESXi550-201703401-SG has an uninitialized stack memory usage in SVGA. This     issue may allow a guest to execute code on the host. (CVE-2017-4903)     Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of VMware Workstation installed on the remote Windows host is 12.x prior to 12.5.5. It is, therefore, affected by multiple vulnerabilities :

  - A heap buffer overflow condition exists due to improper     validation of certain input. An attacker on the guest     can exploit this to cause a denial of service condition     or the execution of arbitrary code on the host.
    (CVE-2017-4902)

  - A stack memory initialization flaw exists that allows an     attacker on the guest to execute arbitrary code on the     host. (CVE-2017-4903)

  - An unspecified flaw exists in memory initialization that     allows an attacker on the guest to execute arbitrary     code on the host. (CVE-2017-4904)

  - An unspecified flaw exists in memory initialization that     allows the disclosure of sensitive information.
    (CVE-2017-4905)

The version of VMware Workstation installed on the remote Linux host is 12.x prior to 12.5.5. It is, therefore, affected by multiple vulnerabilities :

  - A heap buffer overflow condition exists due to improper     validation of certain input. An attacker on the guest     can exploit this to cause a denial of service condition     or the execution of arbitrary code on the host.
    (CVE-2017-4902)

  - A stack memory initialization flaw exists that allows an     attacker on the guest to execute arbitrary code on the     host. (CVE-2017-4903)

  - An unspecified flaw exists in memory initialization that     allows an attacker on the guest to execute arbitrary     code on the host. (CVE-2017-4904)

  - An unspecified flaw exists in memory initialization that     allows the disclosure of sensitive information.
    (CVE-2017-4905)

The version of VMware Fusion installed on the remote macOS or Mac OS X host is 8.x prior to 8.5.6. It is, therefore, affected by multiple vulnerabilities :

  - A heap buffer overflow condition exists due to improper     validation of certain input. An attacker on the guest     can exploit this to cause a denial of service condition     or the execution of arbitrary code on the host.
    (CVE-2017-4902)

  - A stack memory initialization flaw exists that allows an     attacker on the guest to execute arbitrary code on the     host. (CVE-2017-4903)

  - An unspecified flaw exists in memory initialization that     allows an attacker on the guest to execute arbitrary     code on the host. (CVE-2017-4904)

  - An unspecified flaw exists in memory initialization that     allows the disclosure of sensitive information.
    (CVE-2017-4905)

a. ESXi, Workstation, Fusion SVGA memory corruption

ESXi, Workstation, Fusion have a heap buffer overflow and uninitialized stack memory usage in SVGA. These issues may allow a guest to execute code on the host.

VMware would like to thank ZDI and Team 360 Security from Qihoo for reporting these issues to us.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifiers CVE-2017-4902 (heap issue) and CVE-2017-4903 (stack issue) to these issues.

Note: ESXi 6.0 is affected by CVE-2017-4903 but not by CVE-2017-4902.

b. ESXi, Workstation, Fusion XHCI uninitialized memory usage

The ESXi, Workstation, and Fusion XHCI controller has uninitialized memory usage. This issue may allow a guest to execute code on the host. The issue is reduced to a Denial of Service of the guest on ESXi 5.5.

VMware would like to thank ZDI and Team Sniper from Tencent Security for reporting this issue to us.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2017-4904 to this issue.

c. ESXi, Workstation, Fusion uninitialized memory usage

ESXi, Workstation, and Fusion have uninitialized memory usage. This issue may lead to an information leak.

VMware would like to thank ZDI and Team Sniper from Tencent Security for reporting this issue to us.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2017-4905 to this issue.

ID	Name	Product	Family	Type	Severity
159257	ESXi 5.5 < Build 5230635 Multiple Vulnerabilities (VMSA-2017-0006) (remote check) (PCI-DSS check)	Nessus	Misc.	Remote	high
99105	VMware Workstation 12.x < 12.5.5 Multiple Vulnerabilities (VMSA-2017-0006)	Nessus	Windows	Local	high
99104	VMware Workstation 12.x < 12.5.5 Multiple Vulnerabilities (VMSA-2017-0006) (Linux)	Nessus	General	Local	high
99103	VMware Fusion 8.x < 8.5.6 Multiple Vulnerabilities (VMSA-2017-0006) (macOS)	Nessus	MacOS X Local Security Checks	Local	high
99102	VMSA-2017-0006 : VMware ESXi, Workstation and Fusion updates address critical and moderate security issues	Nessus	VMware ESX Local Security Checks	Local	high

Detections

Analytics

CVE-2017-4902

high

Tenable Plugins

high

high

high

high

high