Lucene search

VmwareCVE-2019-5522

HistoryJun 06, 2019 - 7:29 p.m.

CVE-2019-5522

2019-06-0619:29:00

CWE-125

vmware

web.nvd.nist.gov

197

cve-2019-5522

vmware tools

windows update

out of bounds read vulnerability

vm3dmp driver

vmtools

windows guest machines

kernel information leakage

denial of service attack

CVSS2

3.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:N/A:P

CVSS3

7.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

AI Score

6.5

Confidence

High

EPSS

Percentile

5.1%

JSON

VMware Tools for Windows update addresses an out of bounds read vulnerability in vm3dmp driver which is installed with vmtools in Windows guest machines. This issue is present in versions 10.2.x and 10.3.x prior to 10.3.10. A local attacker with non-administrative access to a Windows guest with VMware Tools installed may be able to leak kernel information or create a denial of service attack on the same Windows guest machine.

Affected configurations

Nvd

Node

vmwaretoolsRange10.0.0–10.3.10

AND

microsoftwindowsMatch-

VendorProductVersionCPE
vmwaretools*cpe:2.3:a:vmware:tools:*:*:*:*:*:*:*:*
microsoftwindows-cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
vmware	tools	*	cpe:2.3:a:vmware:tools::::::::
microsoft	windows	-	cpe:2.3:o:microsoft:windows:-:::::::*

CNA Affected

[
  {
    "product": "VMware Tools for Windows",
    "vendor": "VMware",
    "versions": [
      {
        "status": "affected",
        "version": "VMware Tools for Windows (10.x before 10.3.10)"
      }
    ]
  }
]

References

www.securityfocus.com/bid/108673

www.vmware.com/security/advisories/VMSA-2019-0009.html

CVSS2

3.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:N/A:P

CVSS3

7.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

AI Score

6.5

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for CVE-2019-5522