PT-2020-3017
CVE-2020-3962
·
تاريخ النشر
2020-06-23
·
تاريخ التحديث
2020-07-01
الوصف من
CVSS 3.1
8.2
عاليةالمقاييسAV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
VMware ESXi versions 7.0 before ESXi 7.0.0-1.20.16321839
VMware ESXi versions 6.7 before ESXi670-202004101-SG
VMware ESXi versions 6.5 before ESXi650-202005401-SG
VMware Workstation versions 15.x before 15.5.5
VMware Fusion versions 11.x before 11.5.5
Description
The issue is related to a use-after-free vulnerability in the SVGA device, specifically when handling the SVGA DXInvalidateContext command. This vulnerability can be exploited by a malicious actor with local access to a virtual machine that has 3D graphics enabled, potentially allowing them to execute code on the hypervisor from the virtual machine.
Recommendations
For VMware ESXi versions 7.0 before ESXi 7.0.0-1.20.16321839, update to ESXi 7.0.0-1.20.16321839 or later.
For VMware ESXi versions 6.7 before ESXi670-202004101-SG, apply the ESXi670-202004101-SG patch.
For VMware ESXi versions 6.5 before ESXi650-202005401-SG, apply the ESXi650-202005401-SG patch.
For VMware Workstation versions 15.x before 15.5.5, update to version 15.5.5 or later.
For VMware Fusion versions 11.x before 11.5.5, update to version 11.5.5 or later.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾