PT-2017-16207 · Vmware · Vmware Esxi+2

Published 2017-09-15 · Updated 2022-02-03 · CVE-2017-4924

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VMware ESXi versions 6.5 without patch ESXi650-201707101-SG VMware Workstation versions 12.x before 12.5.7 VMware Fusion versions 8.x before 8.5.8

Description The issue is an out-of-bounds write vulnerability in the SVGA device, which may allow a guest to execute code on the host.

Recommendations For VMware ESXi version 6.5, apply patch ESXi650-201707101-SG to resolve the issue. For VMware Workstation versions 12.x before 12.5.7, update to version 12.5.7 or later. For VMware Fusion versions 8.x before 8.5.8, update to version 8.5.8 or later.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2017-4924

ZDI-17-738

Affected Products

Vmware Esxi

Vmware Fusion

Vmware Workstation

References · 8

• 🔥 https://0patch.blogspot.com/2017/10/micropatching-hypervisor-with-running.html · Exploit
• https://osv.dev/vulnerability/CVE-2017-4924 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-4924 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-17-738 · Security Note
• https://vmware.com/security/advisories/VMSA-2017-0015.html · Vendor Advisory
• http://securitytracker.com/id/1039366 · Note
• http://securitytracker.com/id/1039365 · Note
• http://securityfocus.com/bid/100843 · Note