Off-by-one in VMware, Inc products - CVE-2020-3969
Published: June 25, 2020 / Updated: July 1, 2020
Vulnerability identifier: #VU29295
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-3969
CWE-ID: CWE-193
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to an off-by-one error in SVGA device when processing SVGA3D commands. A local attacker can trigger an off-by-one error and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
Cloud Foundation
VMware Fusion
VMware Workstation
VMware ESXi
EMC Integrated Data Protection Appliance
VMware Fusion
VMware Workstation
VMware ESXi
EMC Integrated Data Protection Appliance
How to mitigate CVE-2020-3969
Install updates from vendor's website.
Cloud Foundation - update to 3.10
VMware ESXi - update to ESXi_7.0.0-1.20.16321839
VMware Fusion - update to 11.5.5
VMware Workstation - update to 15.5.5
EMC Integrated Data Protection Appliance - update to 2.6.0
VMware ESXi - update to ESXi_7.0.0-1.20.16321839
VMware Fusion - update to 11.5.5
VMware Workstation - update to 15.5.5
EMC Integrated Data Protection Appliance - update to 2.6.0