https://www.vmware.com/security/advisories/VMSA-2020-0015.html

https://www.zerodayinitiative.com/advisories/ZDI-20-785/

a. Use-after-free vulnerability in SVGA device (CVE-2020-3962)

VMware ESXi, Workstation and Fusion contain a Use-after-free vulnerability in the SVGA device. A malicious actor with local access to a virtual machine with 3D graphics enabled may be able to exploit this vulnerability to execute code on the hypervisor from a virtual machine.

b. Off-by-one heap-overflow vulnerability in SVGA device (CVE-2020-3969)

VMware ESXi, Workstation and Fusion contain an off-by-one heap-overflow vulnerability in the SVGA device. A malicious actor with local access to a virtual machine with 3D graphics enabled may be able to exploit this vulnerability to execute code on the hypervisor from a virtual machine. Additional conditions beyond the attackers control must be present for exploitation to be possible.

c. Out-of-bound read issue in Shader Functionality (CVE-2020-3970)

VMware ESXi, Workstation and Fusion contain an out-of-bounds read vulnerability in the Shader functionality. A malicious actor with non-administrative local access to a virtual machine with 3D graphics enabled may be able to exploit this vulnerability to crash the virtual machines vmx process leading to a partial denial of service condition.

d. Heap-overflow issue in EHCI controller (CVE-2020-3967)

VMware ESXi, Workstation and Fusion contain a heap-overflow vulnerability in the USB 2.0 controller (EHCI). A malicious actor with local access to a virtual machine may be able to exploit this vulnerability to execute code on the hypervisor from a virtual machine. Additional conditions beyond the attackers control must be present for exploitation to be possible.

e. Out-of-bounds write vulnerability in xHCI controller (CVE-2020-3968)

VMware ESXi, Workstation and Fusion contain an out-of-bounds write vulnerability in the USB 3.0 controller (xHCI). A malicious actor with local administrative privileges on a virtual machine may be able to exploit this issue to crash the virtual machines vmx process leading to a denial of service condition or execute code on the hypervisor from a virtual machine. Additional conditions beyond the attackers control must be present for exploitation to be possible.

f. Heap-overflow due to race condition in EHCI controller (CVE-2020-3966)

VMware ESXi, Workstation and Fusion contain a heap-overflow due to a race condition issue in the USB 2.0 controller (EHCI). A malicious actor with local access to a virtual machine may be able to exploit this vulnerability to execute code on the hypervisor from a virtual machine. Additional conditions beyond the attackers control must be present for exploitation to be possible.

g. Information leak in the XHCI USB controller (CVE-2020-3965)

VMware ESXi, Workstation and Fusion contain an information leak in the XHCI USB controller. A malicious actor with local access to a virtual machine may be able to read privileged information contained in hypervisor memory from a virtual machine.

h. Information Leak in the EHCI USB controller (CVE-2020-3964) Description

VMware ESXi, Workstation and Fusion contain an information leak in the EHCI USB controller. A malicious actor with local access to a virtual machine may be able to read privileged information contained in the hypervisors memory. Additional conditions beyond the attackers control need to be present for exploitation to be possible.

i. Use-after-free vulnerability in PVNVRAM (CVE-2020-3963)

VMware ESXi, Workstation and Fusion contain a Use-after-free vulnerability in PVNVRAM. A malicious actor with local access to a virtual machine may be able to read privileged information contained in physical memory.

j. Heap overflow vulnerability in vmxnet3 (CVE-2020-3971)

VMware ESXi, Fusion and Workstation contain a heap overflow vulnerability in the vmxnet3 virtual network adapter. A malicious actor with local access to a virtual machine with a vmxnet3 network adapter present may be able to read privileged information contained in physical memory.

CVE-2020-3962

high

Tenable Plugins

high