Information disclosure in VMware vSphere, Workstation, and Fusion

1) Side-channel attack

EUVDB-ID: #VU14412

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-3646

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows an adjacent attacker to obtain potentially sensitive information.

The vulnerability exists due to an error in systems with microprocessors utilizing speculative execution and address translations. An adjacent attacker with guest OS privilege can trigger terminal page fault, conduct side-channel attack and gain access to potentially sensitive information residing in the L1 data cache.

Mitigation

Update vCenter Server to versions 5.5u3j, 6.0u3h, 6.5u2c, 6.7.0d. Update Workstation to version 14.1.3. Update Fusion to version 10.1.3. Apply patch for vSphere ESXi from vendor's website.

Vulnerable software versions

vCenter Server: 5.5.0 - 6.7.0

VMware ESXi: 5.5 - 6.7

VMware Workstation: 14.0 - 14.1.2

VMware Fusion: 10.0 - 10.1.2

External links

http://www.vmware.com/security/advisories/VMSA-2018-0020.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.