VMware Security Vulnerabilities Leads to Code Execution and Cause DoS Condition

Vmware fixed multiple security vulnerabilities that may lead to code execution, information disclosure and DoS condition with normal user privileges.

Products Affected

  • VMware vSphere ESXi (ESXi)
  • VMware Workstation Pro / Player (Workstation)
  • VMware Fusion Pro / Fusion (Fusion)

Vmware Security Vulnerabilities

The Out-of-bounds read/write vulnerabilities resides in the pixel shader functionality of the VMware ESXi, Workstation and Fusion, the vulnerability can be tracked as

  • CVE-2019-5521 – Out-of-bounds read vulnerability – CVSSv3 = 6.3-7.7
  • CVE-2019-5684 – Out-of-bounds write vulnerability – CVSSv3 = 8.5

Vulnerability Exploitation

To exploit the vulnerability an attacker could have access to the virtual machine with 3D graphics enabled. By default, it is enabled with Workstation Pro and Fusion Pro.

The Out-of-bounds read vulnerability allows attackers to read sensitive information from other memory locations. This may lead to information disclosure and an attacker could cause DoS attack condition with normal user privileges.

The out-of-bounds writes data past the end, or before the beginning, this vulnerability can be exploited only if the host has an affected NVIDIA graphics driver. Successful exploitation of the attack allows an attacker to executed code on the host.

How to Address the issue

The vulnerability can be addressed by updating to the latest version of the product and the workaround is by disabling the 3D-acceleration feature.

  • VMware vSphere ESXi (ESXi) (ESXi670-201904101-SG, ESXi650-201903001)
  • VMWare Fusion (10.1.6, 11.0.3)
  • VMWare Workstation (14.1.6, 15.0.3)

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates also you can take the Best Cybersecurity course online to keep yourself updated.

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

Hackers Use ConnectWise SkyKick Credentials to Access Microsoft 365, Halting Cloud Backups

Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…

1 day ago

Anthropic’s Claude AI Uncovers Origins of NSA-Provided Cryptographic Keys After 25 Years

Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…

1 day ago

Critical WordPress Flaws Allow Attackers to Execute Remote Code Without Authentication

Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…

1 day ago

OpenBSD Kernel Flaw Dating Back 37 Years Enables Local Privilege Escalation to Root

A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…

1 day ago

GhostAction Hackers Hide Credential-Stealing Malware in Fake Font Files Across 94 GitHub Repositories

GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…

1 day ago

SideCopy Hackers Target Indian Organizations With ReverseRAT Malware to Steal Data

Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…

1 day ago