ID CVE-2020-3966 Type cve Reporter cve@mitre.org Modified 2020-07-01T17:57:00
Description
VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.2), and Fusion (11.x before 11.5.2) contain a heap-overflow due to a race condition issue in the USB 2.0 controller (EHCI). A malicious actor with local access to a virtual machine may be able to exploit this vulnerability to execute code on the hypervisor from a virtual machine. Additional conditions beyond the attacker's control must be present for exploitation to be possible.
{"zdi": [{"lastseen": "2020-06-30T19:24:56", "bulletinFamily": "info", "cvelist": ["CVE-2020-3966"], "description": "This vulnerability allows local attackers to escalate privileges on affected installations of VMware Workstation. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the EHCI component. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the hypervisor.", "edition": 1, "modified": "2020-06-30T00:00:00", "published": "2020-06-30T00:00:00", "id": "ZDI-20-783", "href": "https://www.zerodayinitiative.com/advisories/ZDI-20-783/", "title": "VMware Workstation EHCI Time-Of-Check Time-Of-Use Privilege Escalation Vulnerability", "type": "zdi", "cvss": {"score": 0.0, "vector": "NONE"}}], "nessus": [{"lastseen": "2020-07-07T05:00:44", "description": "a. Use-after-free vulnerability in SVGA device (CVE-2020-3962)\n\nVMware ESXi, Workstation and Fusion contain a Use-after-free\nvulnerability in the SVGA device. A malicious actor with local access\nto a virtual machine with 3D graphics enabled may be able to exploit\nthis vulnerability to execute code on the hypervisor from a virtual\nmachine.\n\nb. Off-by-one heap-overflow vulnerability in SVGA device (CVE-2020-3969)\n\nVMware ESXi, Workstation and Fusion contain an off-by-one\nheap-overflow vulnerability in the SVGA device. A malicious actor with\nlocal access to a virtual machine with 3D graphics enabled may be able\nto exploit this vulnerability to execute code on the hypervisor from a\nvirtual machine. Additional conditions beyond the attackers control\nmust be present for exploitation to be possible.\n\nc. Out-of-bound read issue in Shader Functionality (CVE-2020-3970)\n\nVMware ESXi, Workstation and Fusion contain an out-of-bounds read\nvulnerability in the Shader functionality. A malicious actor with\nnon-administrative local access to a virtual machine with 3D graphics\nenabled may be able to exploit this vulnerability to crash the virtual\nmachines vmx process leading to a partial denial of service condition.\n\nd. Heap-overflow issue in EHCI controller (CVE-2020-3967)\n\nVMware ESXi, Workstation and Fusion contain a heap-overflow\nvulnerability in the USB 2.0 controller (EHCI). A malicious actor with\nlocal access to a virtual machine may be able to exploit this\nvulnerability to execute code on the hypervisor from a virtual\nmachine. Additional conditions beyond the attackers control must be\npresent for exploitation to be possible.\n\ne. Out-of-bounds write vulnerability in xHCI controller (CVE-2020-3968)\n\nVMware ESXi, Workstation and Fusion contain an out-of-bounds write\nvulnerability in the USB 3.0 controller (xHCI). A malicious actor with\nlocal administrative privileges on a virtual machine may be able to\nexploit this issue to crash the virtual machines vmx process leading\nto a denial of service condition or execute code on the hypervisor\nfrom a virtual machine. Additional conditions beyond the attackers\ncontrol must be present for exploitation to be possible.\n\nf. Heap-overflow due to race condition in EHCI controller (CVE-2020-3966)\n\nVMware ESXi, Workstation and Fusion contain a heap-overflow due to a\nrace condition issue in the USB 2.0 controller (EHCI). A malicious\nactor with local access to a virtual machine may be able to exploit\nthis vulnerability to execute code on the hypervisor from a virtual\nmachine. Additional conditions beyond the attackers control must be\npresent for exploitation to be possible.\n\ng. Information leak in the XHCI USB controller (CVE-2020-3965)\n\nVMware ESXi, Workstation and Fusion contain an information leak in the\nXHCI USB controller. A malicious actor with local access to a virtual\nmachine may be able to read privileged information contained in\nhypervisor memory from a virtual machine.\n\nh. Information Leak in the EHCI USB controller (CVE-2020-3964)\nDescription\n\nVMware ESXi, Workstation and Fusion contain an information leak in the\nEHCI USB controller. A malicious actor with local access to a virtual\nmachine may be able to read privileged information contained in the\nhypervisors memory. Additional conditions beyond the attackers control\nneed to be present for exploitation to be possible.\n\ni. Use-after-free vulnerability in PVNVRAM (CVE-2020-3963)\n\nVMware ESXi, Workstation and Fusion contain a Use-after-free\nvulnerability in PVNVRAM. A malicious actor with local access to a\nvirtual machine may be able to read privileged information contained\nin physical memory.\n\nj. Heap overflow vulnerability in vmxnet3 (CVE-2020-3971)\n\nVMware ESXi, Fusion and Workstation contain a heap overflow\nvulnerability in the vmxnet3 virtual network adapter. A malicious\nactor with local access to a virtual machine with a vmxnet3 network\nadapter present may be able to read privileged information contained\nin physical memory.", "edition": 6, "cvss3": {"score": 8.2, "vector": "AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"}, "published": "2020-06-25T00:00:00", "title": "VMSA-2020-0015 : VMware ESXi, Workstation, and Fusion updates address multiple security vulnerabilities", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2020-3963", "CVE-2020-3965", "CVE-2020-3969", "CVE-2020-3964", "CVE-2020-3968", "CVE-2020-3971", "CVE-2020-3967", "CVE-2020-3962", "CVE-2020-3970", "CVE-2020-3966"], "modified": "2020-06-25T00:00:00", "cpe": ["cpe:/o:vmware:esxi:6.5", "cpe:/o:vmware:esxi:6.7"], "id": "VMWARE_VMSA-2020-0015.NASL", "href": "https://www.tenable.com/plugins/nessus/137826", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from VMware Security Advisory 2020-0015. \n# The text itself is copyright (C) VMware Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(137826);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/07/06\");\n\n script_cve_id(\"CVE-2020-3962\", \"CVE-2020-3963\", \"CVE-2020-3964\", \"CVE-2020-3965\", \"CVE-2020-3966\", \"CVE-2020-3967\", \"CVE-2020-3968\", \"CVE-2020-3969\", \"CVE-2020-3970\", \"CVE-2020-3971\");\n script_xref(name:\"VMSA\", value:\"2020-0015\");\n script_xref(name:\"IAVA\", value:\"2020-A-0265\");\n\n script_name(english:\"VMSA-2020-0015 : VMware ESXi, Workstation, and Fusion updates address multiple security vulnerabilities\");\n script_summary(english:\"Checks esxupdate output for the patches\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\n\"The remote VMware ESXi host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"a. Use-after-free vulnerability in SVGA device (CVE-2020-3962)\n\nVMware ESXi, Workstation and Fusion contain a Use-after-free\nvulnerability in the SVGA device. A malicious actor with local access\nto a virtual machine with 3D graphics enabled may be able to exploit\nthis vulnerability to execute code on the hypervisor from a virtual\nmachine.\n\nb. Off-by-one heap-overflow vulnerability in SVGA device (CVE-2020-3969)\n\nVMware ESXi, Workstation and Fusion contain an off-by-one\nheap-overflow vulnerability in the SVGA device. A malicious actor with\nlocal access to a virtual machine with 3D graphics enabled may be able\nto exploit this vulnerability to execute code on the hypervisor from a\nvirtual machine. Additional conditions beyond the attackers control\nmust be present for exploitation to be possible.\n\nc. Out-of-bound read issue in Shader Functionality (CVE-2020-3970)\n\nVMware ESXi, Workstation and Fusion contain an out-of-bounds read\nvulnerability in the Shader functionality. A malicious actor with\nnon-administrative local access to a virtual machine with 3D graphics\nenabled may be able to exploit this vulnerability to crash the virtual\nmachines vmx process leading to a partial denial of service condition.\n\nd. Heap-overflow issue in EHCI controller (CVE-2020-3967)\n\nVMware ESXi, Workstation and Fusion contain a heap-overflow\nvulnerability in the USB 2.0 controller (EHCI). A malicious actor with\nlocal access to a virtual machine may be able to exploit this\nvulnerability to execute code on the hypervisor from a virtual\nmachine. Additional conditions beyond the attackers control must be\npresent for exploitation to be possible.\n\ne. Out-of-bounds write vulnerability in xHCI controller (CVE-2020-3968)\n\nVMware ESXi, Workstation and Fusion contain an out-of-bounds write\nvulnerability in the USB 3.0 controller (xHCI). A malicious actor with\nlocal administrative privileges on a virtual machine may be able to\nexploit this issue to crash the virtual machines vmx process leading\nto a denial of service condition or execute code on the hypervisor\nfrom a virtual machine. Additional conditions beyond the attackers\ncontrol must be present for exploitation to be possible.\n\nf. Heap-overflow due to race condition in EHCI controller (CVE-2020-3966)\n\nVMware ESXi, Workstation and Fusion contain a heap-overflow due to a\nrace condition issue in the USB 2.0 controller (EHCI). A malicious\nactor with local access to a virtual machine may be able to exploit\nthis vulnerability to execute code on the hypervisor from a virtual\nmachine. Additional conditions beyond the attackers control must be\npresent for exploitation to be possible.\n\ng. Information leak in the XHCI USB controller (CVE-2020-3965)\n\nVMware ESXi, Workstation and Fusion contain an information leak in the\nXHCI USB controller. A malicious actor with local access to a virtual\nmachine may be able to read privileged information contained in\nhypervisor memory from a virtual machine.\n\nh. Information Leak in the EHCI USB controller (CVE-2020-3964)\nDescription\n\nVMware ESXi, Workstation and Fusion contain an information leak in the\nEHCI USB controller. A malicious actor with local access to a virtual\nmachine may be able to read privileged information contained in the\nhypervisors memory. Additional conditions beyond the attackers control\nneed to be present for exploitation to be possible.\n\ni. Use-after-free vulnerability in PVNVRAM (CVE-2020-3963)\n\nVMware ESXi, Workstation and Fusion contain a Use-after-free\nvulnerability in PVNVRAM. A malicious actor with local access to a\nvirtual machine may be able to read privileged information contained\nin physical memory.\n\nj. Heap overflow vulnerability in vmxnet3 (CVE-2020-3971)\n\nVMware ESXi, Fusion and Workstation contain a heap overflow\nvulnerability in the vmxnet3 virtual network adapter. A malicious\nactor with local access to a virtual machine with a vmxnet3 network\nadapter present may be able to read privileged information contained\nin physical memory.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://lists.vmware.com/pipermail/security-announce/2020/000500.html\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Apply the missing patches.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-3968\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:vmware:esxi:6.5\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:vmware:esxi:6.7\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/06/24\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/06/23\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/06/25\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"VMware ESX Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/VMware/release\", \"Host/VMware/version\");\n script_require_ports(\"Host/VMware/esxupdate\", \"Host/VMware/esxcli_software_vibs\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"vmware_esx_packages.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/VMware/release\")) audit(AUDIT_OS_NOT, \"VMware ESX / ESXi\");\nif (\n !get_kb_item(\"Host/VMware/esxcli_software_vibs\") &&\n !get_kb_item(\"Host/VMware/esxupdate\")\n) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ninit_esx_check(date:\"2020-06-23\");\nflag = 0;\n\n\nif (esx_check(ver:\"ESXi 6.5\", vib:\"VMware:esx-base:6.5.0-3.126.16207673\")) flag++;\nif (esx_check(ver:\"ESXi 6.5\", vib:\"VMware:esx-tboot:6.5.0-3.126.16207673\")) flag++;\nif (esx_check(ver:\"ESXi 6.5\", vib:\"VMware:vsan:6.5.0-3.126.15965595\")) flag++;\nif (esx_check(ver:\"ESXi 6.5\", vib:\"VMware:vsanhealth:6.5.0-3.126.15965596\")) flag++;\n\nif (esx_check(ver:\"ESXi 6.7\", vib:\"VMware:esx-base:6.7.0-3.108.16316930\")) flag++;\nif (esx_check(ver:\"ESXi 6.7\", vib:\"VMware:esx-update:6.7.0-3.108.16316930\")) flag++;\nif (esx_check(ver:\"ESXi 6.7\", vib:\"VMware:vsan:6.7.0-3.108.16243518\")) flag++;\nif (esx_check(ver:\"ESXi 6.7\", vib:\"VMware:vsanhealth:6.7.0-3.108.16243519\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:esx_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}}]}
