KLA12098 Multiple vulnerabilities in VMware Workstation and Player

Multiple vulnerabilities were found in VMware Workstation and Player. Malicious users can exploit these vulnerabilities to obtain sensitive information, execute arbitrary code, cause denial of service.

Below is a complete list of vulnerabilities:

1. A out-of-bound read vulnerability in Shader Functionality can be exploited locally to cause denial of service.
2. A information leak vulnerability in the EHCI USB controller can be exploited locally to obtain sensitive information.
3. A heap overflow vulnerability in EHCI controller can be exploited locally to execute arbitrary code.
4. A use after free vulnerability in SVGA device can be exploited locally to execute arbitrary code.
5. A information leak vulnerability in the XHCI USB controller can be exploited locally to obtain sensitive information.
6. A out of bounds write vulnerability in xHCI controller can be exploited locally to cause denial of service or execute arbitrary code.
7. A heap overflow vulnerability in vmxnet3 can be exploited locally to obtain sensitive information.
8. A heap overflow vulnerability in SVGA device can be exploited locally to execute arbitrary code.
9. A use after free vulnerability in PVNVRAM can be exploited to obtain sensitive infromation.

Original advisories

VMSA-2020-0015

Related products

VMware-Workstation

VMware-Player

CVE list

CVE-2020-3970 warning

CVE-2020-3964 warning

CVE-2020-3966 critical

CVE-2020-3962 critical

CVE-2020-3965 high

CVE-2020-3968 critical

CVE-2020-3971 high

CVE-2020-3967 critical

CVE-2020-3969 critical

CVE-2020-3963 high

Solution

Update to the latest version

Download VMWare Workstation

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

Affected Products

• VMware Workstation 15.x earlier than 15.5.5VMware Player 15.x earlier than 15.5.5