Privilege escalation in VMware Fusion and VMware Workstation - CVE-2017-4950
Published: January 12, 2018
Vulnerability identifier: #VU9994
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2017-4950
CWE-ID: CWE-190
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vendor: VMware, Inc
Affected software:
VMware Fusion
VMware Workstation
VMware Fusion
VMware Workstation
Detailed vulnerability description
The vulnerability allows an adjacent attacker to gain elevated privileges on the target system.
The weakness exists on the systems with IPv6 mode enabled due to integer overflow in the VMware NAT service. An adjacent attacker can trigger memory corruption and execute arbitrary code with elevated privileges.
The weakness exists on the systems with IPv6 mode enabled due to integer overflow in the VMware NAT service. An adjacent attacker can trigger memory corruption and execute arbitrary code with elevated privileges.
How to mitigate CVE-2017-4950
The vulnerability is addressed in the following version: 8.5.10, 10.1.1, 12.5.9, 14.1.1.