KLA11296 DoS vulnerability in VMware products

Multiple vulnerabilities were found in VMware products. Malicious users can exploit these vulnerabilities to cause denial of service, gain privileges.

Below is a complete list of vulnerabilities:

1. A NULL pointer dereference vulnerability was found in VMware Workstation and Fusion. By exploiting this vulnerability malicious users can cause denial of service. This vulnerability can be exploited locally via RPC handler;
2. Local information disclosure vulnerability can be exploited to gain privileges;

Original advisories

VMSA-2018-0018

Related products

VMware-Workstation

VMware-Fusion

CVE list

CVE-2018-6972 warning

CVE-2018-6971 warning

Solution

Update to the latest versionDownload Workstation

Download VMware Fusion

Impacts

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

Affected Products

• VMware Workstation 14.x earlier than 14.1.2
  VMware Fusion 10.x earlier than 10.1.2