PT-2020-3043 · Vmware · Vmware Fusion+1

Published 2020-03-13 · Updated 2020-04-04 · CVE-2020-3947

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VMware Workstation versions 15.x before 15.5.2 VMware Fusion versions 11.x before 11.5.2

Description The issue is related to a use-after-free vulnerability in the vmnetdhcp service of VMware Workstation and Fusion. This vulnerability can be exploited to execute arbitrary code on the host from the guest or create a denial-of-service condition of the vmnetdhcp service running on the host machine.

Recommendations For VMware Workstation versions 15.x before 15.5.2, update to version 15.5.2 or later to resolve the issue. For VMware Fusion versions 11.x before 11.5.2, update to version 11.5.2 or later to resolve the issue. As a temporary workaround, consider disabling the vmnetdhcp service until a patch is available.

Fix

DoS

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2020-03332

CVE-2020-3947

ZDI-20-298

Affected Products

Vmware Fusion

Vmware Workstation

References · 8

• https://vmware.com/security/advisories/VMSA-2020-0004.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-3947 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-20-298 · Security Note
• https://bdu.fstec.ru/vul/2020-03332 · Security Note
• https://osv.dev/vulnerability/CVE-2020-3947 · Vendor Advisory
• https://t.me/cybersecuritytechnologies/904 · Telegram Post
• https://t.me/malwr/3040 · Telegram Post
• https://t.me/cvenotify/1769 · Telegram Post