VMWare Releases Fix For Critical ESXi, Workstation Vulnerability
VMware has released security updates to fix critical and high severity vulnerabilities in VMware ESXi, Workstation, Fusion, and Cloud Foundation, allowing for code execution and privilege escalation.
The two vulnerabilities were successfully exploited by Qihoo 360 Vulcan Team’s Xiao Wei and Tianwen Tang during the first day of the 2020 Tianfu Cup Pwn Contest.
Chained for privilege escalation
One of the security bugs, with a critical severity rating and tracked as CVE-2020-4004, allows attackers with local administrative privileges on a virtual machine to abuse a use-after-free vulnerability in the XHCI USB controller of VMware ESXi, Workstation, and Fusion.
Successful exploitation allows for code execution as the virtual machine’s VMX process running on the host, a process used to configure and host VM instances.
Also Read: Going Beyond DPO Meaning: Ever Heard Of Outsourced DPO?
A second vulnerability, tracked as CVE-2020-4005 and rated as high severity, enables attackers to abuse a high severity VMware ESXi privilege escalation bug in the way system calls are managed to escalate privileges.
“A malicious actor with privileges within the VMX process only, may escalate their privileges on the affected system,” VMware says.
However, exploiting CVE-2020-4005 successfully requires changing with the in the XHCI USB controller use-after-free bug.
Workaround to block exploit chain
VMware released security updates to address CVE-2020-4004, but also provides a workaround that involves removing the XHCI (USB 3.x) controller from potentially targeted virtual machines if not in use.
VMware has also issued security updates to address CVE-2020-4005 in all vulnerable VMware ESXi versions.
The company is still working on releasing fixed versions for the VMware Cloud Foundation of ESXi during the coming days.
Two days ago, VMware also patched multiple medium and high severity vulnerabilities in the cloud-hosted and multitenant SD-WAN Orchestrator management service that could lead to code execution, unauthorized data access, Pass-the-Hash attacks, and privilege escalation.
Also Read: Limiting Location Data Exposure: 8 Best Practices
0 Comments