Use-after-free in VMware Workstation - CVE-2019-5525
Published: June 6, 2019
Vulnerability identifier: #VU18688
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2019-5525
CWE-ID: CWE-416
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: VMware, Inc
Affected software:
VMware Workstation
VMware Workstation
Detailed vulnerability description
The vulnerability allows a local user to escalate privileges on the host system.
The vulnerability exists due to a use-after-free error in advanced Linux Sound Architecture (ALSA) backend. A local non-privileged user of a guest OS can use a specially crafted application to trigger use-after-free error and execute arbitrary code on the Linux host where Workstation is installed.
Successful exploitation of the vulnerability may allow an attacker to compromise Linux host operating system.
How to mitigate CVE-2019-5525
Install updates from vendor's website.