PT-2017-16207 · Vmware · Vmware Esxi+2

Publicado 2017-09-15 · Atualizado 2022-02-03 · CVE-2017-4924

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VMware ESXi versions 6.5 without patch ESXi650-201707101-SG VMware Workstation versions 12.x before 12.5.7 VMware Fusion versions 8.x before 8.5.8

Description The issue is an out-of-bounds write vulnerability in the SVGA device, which may allow a guest to execute code on the host.

Recommendations For VMware ESXi version 6.5, apply patch ESXi650-201707101-SG to resolve the issue. For VMware Workstation versions 12.x before 12.5.7, update to version 12.5.7 or later. For VMware Fusion versions 8.x before 8.5.8, update to version 8.5.8 or later.

Exploit

Correção

Memory Corruption

Enumeração de Fraquezas

CWE-787

Identificadores relacionados

CVE-2017-4924

ZDI-17-738

Produtos afetados

Vmware Esxi

Vmware Fusion

Vmware Workstation

Referências · 8

• 🔥 https://0patch.blogspot.com/2017/10/micropatching-hypervisor-with-running.html · Exploit
• https://osv.dev/vulnerability/CVE-2017-4924 · Aviso do Fabricante
• http://securitytracker.com/id/1039366 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-4924 · Nota de Segurança
• http://securitytracker.com/id/1039365 · Nota
• https://zerodayinitiative.com/advisories/ZDI-17-738 · Nota de Segurança
• https://vmware.com/security/advisories/VMSA-2017-0015.html · Aviso do Fabricante
• http://securityfocus.com/bid/100843 · Nota