VMSA-2020-0015 : VMware ESXi, Workstation, and Fusion updates address multiple security vulnerabilities

high Nessus Plugin ID 137826

Language:

Synopsis

The remote VMware ESXi host is missing one or more security-related patches.

Description

a. Use-after-free vulnerability in SVGA device (CVE-2020-3962)

VMware ESXi, Workstation and Fusion contain a Use-after-free vulnerability in the SVGA device. A malicious actor with local access to a virtual machine with 3D graphics enabled may be able to exploit this vulnerability to execute code on the hypervisor from a virtual machine.

b. Off-by-one heap-overflow vulnerability in SVGA device (CVE-2020-3969)

VMware ESXi, Workstation and Fusion contain an off-by-one heap-overflow vulnerability in the SVGA device. A malicious actor with local access to a virtual machine with 3D graphics enabled may be able to exploit this vulnerability to execute code on the hypervisor from a virtual machine. Additional conditions beyond the attackers control must be present for exploitation to be possible.

c. Out-of-bound read issue in Shader Functionality (CVE-2020-3970)

VMware ESXi, Workstation and Fusion contain an out-of-bounds read vulnerability in the Shader functionality. A malicious actor with non-administrative local access to a virtual machine with 3D graphics enabled may be able to exploit this vulnerability to crash the virtual machines vmx process leading to a partial denial of service condition.

d. Heap-overflow issue in EHCI controller (CVE-2020-3967)

VMware ESXi, Workstation and Fusion contain a heap-overflow vulnerability in the USB 2.0 controller (EHCI). A malicious actor with local access to a virtual machine may be able to exploit this vulnerability to execute code on the hypervisor from a virtual machine. Additional conditions beyond the attackers control must be present for exploitation to be possible.

e. Out-of-bounds write vulnerability in xHCI controller (CVE-2020-3968)

VMware ESXi, Workstation and Fusion contain an out-of-bounds write vulnerability in the USB 3.0 controller (xHCI). A malicious actor with local administrative privileges on a virtual machine may be able to exploit this issue to crash the virtual machines vmx process leading to a denial of service condition or execute code on the hypervisor from a virtual machine. Additional conditions beyond the attackers control must be present for exploitation to be possible.

f. Heap-overflow due to race condition in EHCI controller (CVE-2020-3966)

VMware ESXi, Workstation and Fusion contain a heap-overflow due to a race condition issue in the USB 2.0 controller (EHCI). A malicious actor with local access to a virtual machine may be able to exploit this vulnerability to execute code on the hypervisor from a virtual machine. Additional conditions beyond the attackers control must be present for exploitation to be possible.

g. Information leak in the XHCI USB controller (CVE-2020-3965)

VMware ESXi, Workstation and Fusion contain an information leak in the XHCI USB controller. A malicious actor with local access to a virtual machine may be able to read privileged information contained in hypervisor memory from a virtual machine.

h. Information Leak in the EHCI USB controller (CVE-2020-3964) Description

VMware ESXi, Workstation and Fusion contain an information leak in the EHCI USB controller. A malicious actor with local access to a virtual machine may be able to read privileged information contained in the hypervisors memory. Additional conditions beyond the attackers control need to be present for exploitation to be possible.

i. Use-after-free vulnerability in PVNVRAM (CVE-2020-3963)

VMware ESXi, Workstation and Fusion contain a Use-after-free vulnerability in PVNVRAM. A malicious actor with local access to a virtual machine may be able to read privileged information contained in physical memory.

j. Heap overflow vulnerability in vmxnet3 (CVE-2020-3971)

VMware ESXi, Fusion and Workstation contain a heap overflow vulnerability in the vmxnet3 virtual network adapter. A malicious actor with local access to a virtual machine with a vmxnet3 network adapter present may be able to read privileged information contained in physical memory.

Solution

Apply the missing patches.

See Also

http://lists.vmware.com/pipermail/security-announce/2020/000500.html

Plugin Details

Severity: High

ID: 137826

File Name: vmware_VMSA-2020-0015.nasl

Version: 1.5

Type: local

Published: 6/25/2020

Updated: 7/6/2020

Risk Information

VPR

Risk Factor: Medium

Score: 6.5

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2020-3968

CVSS v3

Risk Factor: High

Base Score: 8.2

Temporal Score: 7.1

Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:vmware:esxi:6.5, cpe:/o:vmware:esxi:6.7

Required KB Items: Host/local_checks_enabled, Host/VMware/version, Host/VMware/release

Exploit Ease: No known exploits are available

Patch Publication Date: 6/23/2020

Vulnerability Publication Date: 6/24/2020

Reference Information

CVE: CVE-2020-3962, CVE-2020-3963, CVE-2020-3964, CVE-2020-3965, CVE-2020-3966, CVE-2020-3967, CVE-2020-3968, CVE-2020-3969, CVE-2020-3970, CVE-2020-3971

VMSA: 2020-0015

IAVA: 2020-A-0265