VMware ESXi/ESX VMCI privilege escalation vulnerability (VMSA-2013-0002)

# SPDX-FileCopyrightText: 2013 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.103662");
  script_cve_id("CVE-2013-1406");
  script_tag(name:"cvss_base", value:"7.2");
  script_tag(name:"cvss_base_vector", value:"AV:L/AC:L/Au:N/C:C/I:C/A:C");
  script_version("2026-04-28T06:28:06+0000");
  script_name("VMware ESXi/ESX VMCI privilege escalation vulnerability (VMSA-2013-0002)");
  script_tag(name:"last_modification", value:"2026-04-28 06:28:06 +0000 (Tue, 28 Apr 2026)");
  script_tag(name:"creation_date", value:"2013-02-14 10:04:01 +0100 (Thu, 14 Feb 2013)");
  script_category(ACT_GATHER_INFO);
  script_family("VMware Local Security Checks");
  script_copyright("Copyright (C) 2013 Greenbone AG");
  script_dependencies("gb_vmware_esxi_init.nasl");
  script_mandatory_keys("VMware/ESXi/LSC", "VMware/ESX/version");

  script_tag(name:"summary", value:"The remote ESXi is missing one or more security related Updates from VMSA-2013-0002.");

  script_tag(name:"solution", value:"Apply the missing patch(es).");

  script_tag(name:"vuldetect", value:"Checks if the target host is missing one or more patch(es).");

  script_tag(name:"affected", value:"VMware ESXi 5.1 without ESXi510-201212102-SG

  VMware ESXi 5.0 without ESXi500-201212102-SG

  VMware ESXi 4.1.without ESXi410-201211402-BG

  VMware ESXi 4.0 without ESXi400-201302402-SG

  VMware ESX 4.1.without ESX410-201211401-SG

  VMware ESX 4.0 without ESX400-201302401-SG");

  script_tag(name:"insight", value:"a. VMware VMCI privilege escalation

  VMware ESX, Workstation, Fusion, and View contain a vulnerability in the
  handling of control code in vmci.sys. A local malicious user may exploit this
  vulnerability to manipulate the memory allocation through the Virtual Machine
  Communication Interface (VMCI) code. This could result in a privilege escalation
  on Windows-based hosts and on Windows-based Guest Operating Systems.

  The vulnerability does not allow for privilege escalation from the Guest
  Operating System to the host (and vice versa). This means that host memory can
  not be manipulated from the Guest Operating System (and vice versa).

  Systems that have VMCI disabled are also affected by this issue.");

  script_tag(name:"qod_type", value:"package");
  script_tag(name:"solution_type", value:"VendorFix");

  script_xref(name:"URL", value:"http://www.vmware.com/security/advisories/VMSA-2013-0002.html");

  exit(0);
}

include("vmware_esx.inc");
include("version_func.inc");

if(!get_kb_item("VMware/ESXi/LSC"))
  exit(0);

if(!esxVersion = get_kb_item("VMware/ESX/version"))
  exit(0);

patches = make_array("4.0.0", "ESXi400-201302402-SG",
                     "4.1.0", "ESXi410-201301401-SG",
                     "5.0.0", "VIB:esx-base:5.0.0-1.25.912577",
                     "5.1.0", "VIB:tools-light:5.1.0-0.8.911593");

if(!patches[esxVersion])
  exit(99);

if(report = esxi_patch_missing(esxi_version:esxVersion, patch:patches[esxVersion])) {
  security_message(port:0, data:report);
  exit(0);
}

exit(99);