Heap-based buffer overflow in VMware, Inc products - CVE-2020-3967

Vulnerability identifier: #VU29298

CSH Severity: Low

CVSS v4: 7.5 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-3967

CWE-ID: CWE-122

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to escalate privileges on the system.

The vulnerability exists due to a boundary error in EHCI controller. A local attacker can pass specially crafted data to the application, trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Cloud Foundation
VMware Fusion
VMware Workstation
VMware ESXi
EMC Integrated Data Protection Appliance
PowerFlex rack

Install updates from vendor's website.

Cloud Foundation - update to 3.10
VMware ESXi - addressed in versions ESXi_7.0.0-1.20.16321839, ESXi650-202005401-SG, ESXi670-202004101-SG
VMware Fusion - update to 11.5.5
VMware Workstation - update to 15.5.5
EMC Integrated Data Protection Appliance - update to 2.6.0
PowerFlex rack - addressed in versions 3.3.8.1, 3.4.3.1, 3.5.3.1

• https://exchange.xforce.ibmcloud.com/vulnerabilities/183922
• https://www.zerodayinitiative.com/advisories/ZDI-20-784/

• Multiple vulnerabilities in VMware ESXi, Fusion, Workstation and Cloud Foundation
• Multiple vulnerabilities in Dell EMC Integrated Data Protection Appliance
• Multiple vulnerabilities in Dell EMC PowerFlex Rack