VMware Workstation 10.0.0.40273 vmx86 Driver vmx86.sys IOCTL input validation ⚔ [Disputed]

Summaryinfo

A vulnerability was found in VMware Workstation 10.0.0.40273. It has been classified as problematic. This vulnerability affects unknown code of the file vmx86.sys of the component vmx86 Driver. Performing a manipulation as part of IOCTL results in input validation. Furthermore, an exploit is available. There is ongoing doubt regarding the real existence of this vulnerability.

Detailsinfo

A vulnerability, which was classified as problematic, was found in VMware Workstation 10.0.0.40273 (Virtualization Software). This affects an unknown code block of the file vmx86.sys of the component vmx86 Driver. The manipulation as part of a IOCTL leads to a input validation vulnerability. CWE is classifying the issue as CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. This is going to have an impact on confidentiality.

The weakness was published 11/04/2014 as KL-001-2014-004 as not defined posting (Bugtraq). It is possible to read the advisory at archives.neohapsis.com. The public release has been coordinated with VMware. The exploitability is told to be easy. Attacking locally is a requirement. No form of authentication is needed for exploitation. Technical details and a public exploit are known. The advisory points out:

The first four bytes of the InputBuffer parameter passed to DeviceIoControl is used as the source parameter in a memcpy call. The InputBuffer must be a minimum of eight bytes long in order to trigger the vulnerability. The OutputBuffer parameter passed to DeviceIoControl is used as the destination address for the output from the DeviceIoControl call. In this case, the data returned is the same data residing at the source paramter of memcpy. This can therefore be abused in a way that allows an attacker to arbitrarily define a kernel address, and have the memory stored at that address be returned to the attacker at an address residing in userland.

A public exploit has been developed in Python and been published immediately after the advisory. The exploit is shared for download at archives.neohapsis.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 88 days. During that time the estimated underground price was around $5k-$25k. The real existence of this vulnerability is still doubted at the moment.

The posting contains the following remark:

VMWare responds that they have decided the reported vulnerability is not a security issue. VMWare creates a Knowledge Base article comparing the __vmware__ group to a Microsoft Windows Power User account.

The vulnerability is also documented in the vulnerability database at X-Force (98496). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Virtualization Software

Vendor

• VMware

Name

• Workstation

Version

• 10.0.0.40273

License

• commercial

Website

• Vendor: https://www.vmware.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion