Out-of-bounds read in VMware ESXi - CVE-2020-3981
Published: October 20, 2020 / Updated: December 14, 2022
Vulnerability identifier: #VU47748
CSH Severity: Medium
CVSS v4: 6.8 [CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-3981
CWE-ID: CWE-125
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition due to a time-of-check time-of-use issue in ACPI device within the implementation of the BDOOR_CMD_PATCH_ACPI_TABLES command. A remote administrator on a guest OS can run a specially crafted program to read memory from the vmx process.
Affected software
VMware ESXi
VMware Fusion
VMware Workstation
Dell EMC VxRail Appliance
VMware Fusion
VMware Workstation
Dell EMC VxRail Appliance
How to mitigate CVE-2020-3981
Install updates from vendor's website.
VMware ESXi - addressed in versions ESXi_7.0.1-0.0.16850804, ESXi650-202007101-SG, ESXi670-202008101-SG
VMware Fusion - update to 11.5.6
VMware Workstation - update to 15.5.7
Dell EMC VxRail Appliance - addressed in versions 4.5.452, 4.7.525, 7.0.101
VMware Fusion - update to 11.5.6
VMware Workstation - update to 15.5.7
Dell EMC VxRail Appliance - addressed in versions 4.5.452, 4.7.525, 7.0.101