Privilege escalation in VMware Fusion - CVE-2018-6962

Vulnerability identifier: #VU12990

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-6962

CWE-ID: CWE-264

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain elevated privileges on the target system.

The vulnerability exists due to a signature bypass flaw. A local attacker can gain elevated privileges.

VMware Fusion
Ubuntu
Fedora
patch
linux-image-6.8.0-1008-oracle (Ubuntu package)
linux-image-6.8.0-1008-oracle-64k (Ubuntu package)
linux-image-oracle (Ubuntu package)
linux-image-oracle-64k (Ubuntu package)

Update to version 10.1.2.

patch - update to 2.7.6-3.fc26
linux-image-6.8.0-1008-oracle (Ubuntu package) - update to 6.8.0-1008.8
linux-image-6.8.0-1008-oracle-64k (Ubuntu package) - update to 6.8.0-1008.8
linux-image-oracle (Ubuntu package) - update to 6.8.0-1008.8
linux-image-oracle-64k (Ubuntu package) - update to 6.8.0-1008.8

• https://www.vmware.com/security/advisories/VMSA-2018-0013.html

• Multiple vulnerabilities in VMware Workstation and Fusion
• Ubuntu update for linux-oracle
• Fedora 26 update for patch