Severity Rating: High
Software Affected
· VMware ESXi 6.5, 6.7, 7.0
· VMware Workstation Pro / Player (Workstation) prior to 15.5.2
· VMware Fusion Pro / Fusion (Fusion) prior to 11.5.5
· VMware Remote Console for Mac (VMRC for Mac) 11.x and prior
· VMware Horizon Client for Mac 5.x and prior
Overview
These vulnerabilities have been reported in VMware that could allow a
remote attacker to escalate their privileges to root and non-administrative
access to a virtual machine to crash virtual machine's vmx on the targeted
system.
Description
1. Privilege Escalation Vulnerability (CVE-2020-3957)
This vulnerability exists in VMware core due to a Time-of-check Time-of-use
(TOCTOU) issue in the service opener. Successful exploitation of this
Vulnerability could allow the attackers with normal user privileges to
escalate their privileges to root on the targeted system .
2. Denial-of-service Vulnerability (CVE-2020-3958)
This vulnerability exists in VMware due to reachable assertion in the
shader functionality. A remote attacker could exploit this vulnerability by
pass a malformed pixel shader (inside VMware guest OS) and perform a denial
of service (DoS) attack due a panic condition in the vmware-vmx.exe process
on host.
Successful exploitation of this issue may allow attackers with
non-administrative access to a virtual machine to crash the virtual
machine's vmx process leading to a denial of service condition.
3. Memory leak Vulnerability (CVE-2020-3959)
This vulnerability exists in VMware due to memory leak in the VMCI module.
An attacker could exploit this vulnerability by gaining local
non-administrative access to a virtual machine.
Successful exploitation of this Vulnerability could allow the attacker to
crash the virtual machine's vmx process leading to a partial denial of
service on the targeted system.
Solution
Apply appropriate fixes as issued by vendor in:
Vendor Information
VMware
Reference
VMware
NVD
CVE Name
CVE-2020-3957
CVE-2020-3958
CVE-2020-3959