Out-of-bounds write in VMware, Inc products - CVE-2020-3968

Vulnerability identifier: #VU29297

CSH Severity: Low

CVSS v4: 7.5 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-3968

CWE-ID: CWE-787

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to escalate privileges on the system.

The vulnerability exists due to a boundary error when processing untrusted input in xHCI controller. A local attacker can trigger out-of-bounds write and execute arbitrary code on the target system.

Cloud Foundation
VMware Fusion
VMware Workstation
VMware ESXi
EMC Integrated Data Protection Appliance
PowerFlex rack

Install updates from vendor's website.

Cloud Foundation - update to 3.10
VMware ESXi - addressed in versions ESXi_7.0.0-1.20.16321839, ESXi650-202005401-SG, ESXi670-202004101-SG
VMware Fusion - update to 11.5.5
VMware Workstation - update to 15.5.5
EMC Integrated Data Protection Appliance - update to 2.6.0
PowerFlex rack - addressed in versions 3.3.8.1, 3.4.3.1, 3.5.3.1

• https://www.zerodayinitiative.com/advisories/ZDI-20-781/
• https://www.vmware.com/security/advisories/VMSA-2020-0015.html

• Multiple vulnerabilities in VMware ESXi, Fusion, Workstation and Cloud Foundation
• Multiple vulnerabilities in Dell EMC Integrated Data Protection Appliance
• Multiple vulnerabilities in Dell EMC PowerFlex Rack