VMware ESXi/Workstation/Fusion USB 2.0 Controller out-of-bounds write

entryeditHistoryDiffjsonxmlCTI

A vulnerability, which was classified as critical, has been found in VMware ESXi, Workstation and Fusion (Virtualization Software) (unknown version). This issue affects an unknown functionality of the component USB 2.0 Controller. Upgrading eliminates this vulnerability.

Field06/26/2020 12:47 PM06/26/2020 12:52 PM10/27/2020 10:01 AM
vendorVMwareVMwareVMware
nameESXi/Workstation/FusionESXi/Workstation/FusionESXi/Workstation/Fusion
componentUSB 2.0 ControllerUSB 2.0 ControllerUSB 2.0 Controller
risk222
cvss2_vuldb_basescore4.44.44.4
cvss2_vuldb_tempscore3.83.83.8
cvss2_vuldb_avLLL
cvss2_vuldb_acMMM
cvss2_vuldb_auNNN
cvss2_vuldb_ciPPP
cvss2_vuldb_iiPPP
cvss2_vuldb_aiPPP
cvss3_meta_basescore6.66.66.6
cvss3_meta_tempscore6.36.36.3
cvss3_vuldb_basescore5.75.75.7
cvss3_vuldb_tempscore5.55.55.5
cvss3_vuldb_avLLL
cvss3_vuldb_acLLL
cvss3_vuldb_prHHH
cvss3_vuldb_uiNNN
cvss3_vuldb_sCCC
cvss3_vuldb_cLLL
cvss3_vuldb_iLLL
cvss3_vuldb_aLLL
date1593043200 (06/25/2020)1593043200 (06/25/2020)1593043200 (06/25/2020)
urlhttps://www.vmware.com/security/advisories/VMSA-2020-0015.htmlhttps://www.vmware.com/security/advisories/VMSA-2020-0015.htmlhttps://www.vmware.com/security/advisories/VMSA-2020-0015.html
price_0day$5k-$25k$5k-$25k$5k-$25k
nameUpgradeUpgradeUpgrade
cveCVE-2020-3967CVE-2020-3967CVE-2020-3967
seealso157244 157245 157273 157274 157275 157276 157278 157279 157280157244 157245 157273 157274 157275 157276 157278 157279 157280157244 157245 157273 157274 157275 157276 157278 157279 157280
locationWebsiteWebsiteWebsite
cvss2_vuldb_eNDNDND
cvss2_vuldb_rlOFOFOF
cvss2_vuldb_rcNDNDND
cvss3_vuldb_eXXX
cvss3_vuldb_rlOOO
cvss3_vuldb_rcXXX
cvss3_nvd_basescore7.57.57.5
typeVirtualization SoftwareVirtualization Software
cwe0787 (memory corruption)787 (memory corruption)
cvss2_nvd_avLL
cvss2_nvd_acMM
cvss2_nvd_auNN
cvss2_nvd_ciPP
cvss2_nvd_iiPP
cvss2_nvd_aiPP
cvss3_nvd_avLL
cvss3_nvd_acHH
cvss3_nvd_prHH
cvss3_nvd_uiNN
cvss3_nvd_sCC
cvss3_nvd_cHH
cvss3_nvd_iHH
cvss3_nvd_aHH
cve_assigned15776640001577664000
cve_nvd_summaryVMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.5), and Fusion (11.x before 11.5.5) contain a heap-overflow vulnerability in the USB 2.0 controller (EHCI). A malicious actor with local access to a virtual machine may be able to exploit this vulnerability to execute code on the hypervisor from a virtual machine. Additional conditions beyond the attacker's control must be present for exploitation to be possible.VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.5), and Fusion (11.x before 11.5.5) contain a heap-overflow vulnerability in the USB 2.0 controller (EHCI). A malicious actor with local access to a virtual machine may be able to exploit this vulnerability to execute code on the hypervisor from a virtual machine. Additional conditions beyond the attacker's control must be present for exploitation to be possible.
confirm_urlhttps://www.vmware.com/security/advisories/VMSA-2020-0015.html

◂ PreviousOverviewNext ▸

Do you need the next level of professionalism?

Upgrade your account now!