PT-2023-9001 · Vmware · Vmware Fusion

Beist + 3 · Publicado 2023-04-25 · Atualizado 2023-07-13 · CVE-2023-20871

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VMware Fusion (affected versions not specified)

Description The issue is related to a local privilege escalation, where a malicious actor with read/write access to the host operating system can gain root access. This is due to insecure privilege management in the Raw Disk Handler component of the VMware Fusion hypervisor.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Improper Privilege Management

Enumeração de Fraquezas

CWE-863

CWE-269

Identificadores relacionados

BDU:2024-02940

CVE-2023-20871

Produtos afetados

Vmware Fusion

Referências · 9

• https://nvd.nist.gov/vuln/detail/CVE-2023-20871 · Nota de Segurança
• https://t.me/true_secator/4324 · Publicação no Telegram
• https://vuldb.com/?id.227410 · Nota
• https://vmware.com/security/advisories/VMSA-2023-0008.html · Aviso do Fabricante
• https://t.me/cibsecurity/62850 · Publicação no Telegram
• https://t.me/aptreports/4748 · Publicação no Telegram
• https://t.me/aptreports/4749 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-20871 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2024-02940 · Nota de Segurança