VMware ESXi/Workstation/Fusion USB 2.0 Controller race condition

Summaryinfo

A vulnerability classified as critical was found in VMware ESXi, Workstation and Fusion. This impacts an unknown function of the component USB 2.0 Controller. Executing a manipulation can lead to race condition. This vulnerability is handled as CVE-2020-3966. It is possible to launch the attack on the local host. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as critical was found in VMware ESXi, Workstation and Fusion (Virtualization Software) (version unknown). This vulnerability affects an unknown function of the component USB 2.0 Controller. The manipulation with an unknown input leads to a race condition vulnerability. The CWE definition for the vulnerability is CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.2), and Fusion (11.x before 11.5.2) contain a heap-overflow due to a race condition issue in the USB 2.0 controller (EHCI). A malicious actor with local access to a virtual machine may be able to exploit this vulnerability to execute code on the hypervisor from a virtual machine. Additional conditions beyond the attacker's control must be present for exploitation to be possible.

The weakness was released 06/25/2020 (Website). The advisory is shared for download at vmware.com. This vulnerability was named CVE-2020-3966 since 12/30/2019. The attack needs to be approached locally. The successful exploitation requires a single authentication. There are neither technical details nor an exploit publicly available.

Upgrading eliminates this vulnerability.

Entries connected to this vulnerability are available at VDB-157244, VDB-157245, VDB-157273 and VDB-157274. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Virtualization Software

Vendor

• VMware

Name

• ESXi
• Fusion
• Workstation

License

• commercial

Website

• Vendor: https://www.vmware.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion