SB2023042557 - Multiple vulnerabilities in VMware Workstation and Fusion

Description

This security bulletin contains information about 4 vulnerabilities.

1) Stack-based buffer overflow (CVE-ID: CVE-2023-20869)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

The vulnerability allows an attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the UHCI component in the functionality for sharing host Bluetooth devices with the virtual machine. An attacker with administrative account on the guest OS can trigger a stack-based buffer overflow and execute arbitrary code as the virtual machine's VMX process running on the host.

2) Out-of-bounds read (CVE-ID: CVE-2023-20870)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows an attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the UHCI component in the functionality for sharing host Bluetooth devices with the virtual machine. An attacker with administrative access to the guest OS can trigger an out-of-bounds read error and read contents of memory on the host OS.

3) Improper access control (CVE-ID: CVE-2023-20871)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper access restrictions in raw disk functionality. A local user with read/write access to the host operating system can elevate privileges to gain root access to the host operating system.

4) Out-of-bounds write (CVE-ID: CVE-2023-20872)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber

The vulnerability allows an attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error in SCSI CD/DVD device emulation. An attacker with access to a virtual machine that has a physical CD/DVD drive attached and configured to use a virtual SCSI controller can trigger an out-of-bounds write and execute arbitrary code on the hypervisor from a virtual machine.

Remediation

Install update from vendor's website.

References

• https://www.vmware.com/security/advisories/VMSA-2023-0008.html
• https://www.zerodayinitiative.com/advisories/ZDI-23-522/
• https://www.zerodayinitiative.com/advisories/ZDI-23-521/