PT-2020-4413 · Vmware · Vmware Fusion+2

Published 2020-10-20 · Updated 2020-10-30 · CVE-2020-3995

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: VMware ESXi versions 6.7 before ESXi670-201908101-SG VMware ESXi versions 6.5 before ESXi650-202007101-SG VMware Workstation versions 15.x before 15.1.0 VMware Fusion versions 11.x before 11.1.0

Description: The VMCI host drivers used by VMware hypervisors contain a memory leak issue. A malicious actor with access to a virtual machine may be able to trigger a memory leak issue resulting in memory resource exhaustion on the hypervisor if the attack is sustained for extended periods of time. This can lead to a denial of service.

Recommendations: For VMware ESXi versions 6.7 before ESXi670-201908101-SG, update to ESXi670-201908101-SG or later. For VMware ESXi versions 6.5 before ESXi650-202007101-SG, update to ESXi650-202007101-SG or later. For VMware Workstation versions 15.x before 15.1.0, update to 15.1.0 or later. For VMware Fusion versions 11.x before 11.1.0, update to 11.1.0 or later.

Fix

Memory Leak

Resource Exhaustion

Weakness Enumeration

CWE-401

CWE-400

Related Identifiers

BDU:2020-04941

CVE-2020-3995

Affected Products

Vmware Esxi

Vmware Fusion

Vmware Workstation

References · 6

• https://vmware.com/security/advisories/VMSA-2020-0023.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-04941 · Security Note
• https://osv.dev/vulnerability/CVE-2020-3995 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-3995 · Security Note
• https://vuldb.com/?id.162968 · Note
• https://cybersecurity-help.cz/vdb/SB2020102046 · Note