VMware ESXi (6.7 before ESXi670-201810101-SG, 6.5 before ESXi650-201808401-BG, and 6.0 before ESXi600-201808401-BG), Workstation (14.x before 14.1.3) and Fusion (10.x before 10.1.3) contain an out-of-bounds read vulnerability in SVGA device. This issue may allow a guest to execute code on the host.

The version of VMware Workstation installed on the remote Windows host is 14.x prior to 14.1.3. It is, therefore, affected by an out-of-bounds read vulnerability in SVGA devices. An attacker with access to a guest system may be able to execute code on the host system by leveraging this vulnerability.

The remote VMware ESXi host is version 6.0, 6.5, or 6.7 and is missing a security patch. It is, therefore, vulnerable to an out-of-bounds read vulnerability in SVGA devices. An attacker with access to a guest system may be able to execute code on the host system by leveraging this vulnerability.

The version of VMware Fusion installed on the remote macOS or Mac OS X host is 10.x prior to 10.1.3. It is, therefore, affected by an out-of-bounds read vulnerability in SVGA devices. An attacker with access to a guest system may be able to execute code on the host system by leveraging this vulnerability.

The version of VMware Workstation installed on the remote Linux host is 14.x prior to 14.1.3. It is, therefore, affected by an out-of-bounds read vulnerability in SVGA devices. An attacker with access to a guest system may be able to execute code on the host system by leveraging this vulnerability.

Out-of-bounds read vulnerability in SVGA Device

VMware ESXi, Fusion and Workstation contain an out-of-bounds read vulnerability in SVGA device. This issue may allow a guest to execute code on the host.

VMware would like to thank Anonymous working with Trend Micro's Zero Day Initiative for reporting this issue to us.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2018-6974 to this issue.

ID	Name	Product	Family	Type	Severity
118467	VMware Workstation 14.x < 14.1.3 Out-of-Bounds Read Vulnerability (VMSA-2018-0026)	Nessus	Windows	Local	high
118466	ESXi 6.0 / 6.5 / 6.7 Out-of-Bounds Read Vulnerability (VMSA-2018-0026) (Remote Check)	Nessus	Misc.	Remote	high
118465	VMware Fusion 10.x < 10.1.3 Out-of-Bounds Read Vulnerability (VMSA-2018-0026) (macOS)	Nessus	MacOS X Local Security Checks	Local	high
118464	VMware Workstation 14.x < 14.1.3 Out-of-Bounds Read Vulnerability (VMSA-2018-0026) (Linux)	Nessus	General	Local	high
118360	VMSA-2018-0026 : VMware ESXi, Workstation, and Fusion updates address an out-of-bounds read vulnerability	Nessus	VMware ESX Local Security Checks	Local	high

Detections

Analytics

CVE-2018-6974

high

Tenable Plugins

high

high

high

high

high