VMware Workstation 17.0.x < 17.5 Information Disclosure (VMSA-2023-0022)

medium Nessus Plugin ID 183918

Language:

Synopsis

A virtualization application installed on the remote Windows host is affected by an information disclosure vulnerability.

Description

VMware Workstation( 17.x prior to 17.5) contains an out-of-bounds read vulnerability that exists in the functionality for sharing host Bluetooth devices with the virtual machine. A malicious actor with local administrative privileges on a virtual machine may be able to read privileged information contained in hypervisor memory from a virtual machine.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update to VMware Workstation version 17.5, or later.

Plugin Details

Severity: Medium

ID: 183918

File Name: vmware_workstation_vmsa_2023_0022.nasl

Version: 1.3

Type: local

Agent: windows, macosx, unix

Family: General

Published: 10/26/2023

Updated: 3/8/2024

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.1

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.2

Vector: CVSS2#AV:L/AC:L/Au:M/C:C/I:N/A:N

CVSS Score Source: CVE-2023-34044

CVSS v3

Risk Factor: Medium

Base Score: 6

Temporal Score: 5.2

Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:vmware:workstation

Required KB Items: Host/VMware Workstation/Version

Exploit Ease: No known exploits are available

Patch Publication Date: 10/19/2023

Vulnerability Publication Date: 10/19/2023

Reference Information

CVE: CVE-2023-34044

IAVA: 2023-A-0576-S

VMSA: 2023-0022

Detections

Analytics