Out-of-bounds read in Broadcom products - CVE-2020-3960
Published: June 12, 2020
Vulnerability identifier: #VU28991
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-3960
CWE-ID: CWE-125
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in NVMe functionality. A local attacker can trigger out-of-bounds read error and read contents of memory on the system.
Affected software
VMware ESXi
VMware Fusion
VMware Workstation
PowerFlex rack
VMware Fusion
VMware Workstation
PowerFlex rack
How to mitigate CVE-2020-3960
Install updates from vendor's website.
VMware ESXi - addressed in versions ESXi650-202005401-SG, ESXi670-202006401-SG
VMware Fusion - update to 11.5.5
VMware Workstation - update to 15.5.5
PowerFlex rack - addressed in versions 3.3.8.1, 3.4.3.1, 3.5.3.1
VMware Fusion - update to 11.5.5
VMware Workstation - update to 15.5.5
PowerFlex rack - addressed in versions 3.3.8.1, 3.4.3.1, 3.5.3.1