PT-2020-3017 · Vmware · Vmware Fusion+2

Bruno Pujos + 3 · Published 2020-06-23 · Updated 2020-07-01 · CVE-2020-3962

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VMware ESXi versions 7.0 before ESXi 7.0.0-1.20.16321839 VMware ESXi versions 6.7 before ESXi670-202004101-SG VMware ESXi versions 6.5 before ESXi650-202005401-SG VMware Workstation versions 15.x before 15.5.5 VMware Fusion versions 11.x before 11.5.5

Description The issue is related to a use-after-free vulnerability in the SVGA device, specifically when handling the SVGA DXInvalidateContext command. This vulnerability can be exploited by a malicious actor with local access to a virtual machine that has 3D graphics enabled, potentially allowing them to execute code on the hypervisor from the virtual machine.

Recommendations For VMware ESXi versions 7.0 before ESXi 7.0.0-1.20.16321839, update to ESXi 7.0.0-1.20.16321839 or later. For VMware ESXi versions 6.7 before ESXi670-202004101-SG, apply the ESXi670-202004101-SG patch. For VMware ESXi versions 6.5 before ESXi650-202005401-SG, apply the ESXi650-202005401-SG patch. For VMware Workstation versions 15.x before 15.5.5, update to version 15.5.5 or later. For VMware Fusion versions 11.x before 11.5.5, update to version 11.5.5 or later.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2020-03240

CVE-2020-3962

ZDI-20-785

Affected Products

Vmware Esxi

Vmware Fusion

Vmware Workstation

References · 5

• https://vmware.com/security/advisories/VMSA-2020-0015.html · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-20-785 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-3962 · Security Note
• https://osv.dev/vulnerability/CVE-2020-3962 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-03240 · Security Note