VMware ESXi, Workstation, Fusion
At a glance
- Source
- NVD
- EPSS
- EPSS 0.83 % · percentile 58 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- vmware
- NVD status
- Modified
Description
VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202008101-SG, 6.5 before ESXi650-202007101-SG), Workstation (15.x), Fusion (11.x before 11.5.6) contain an out-of-bounds write vulnerability due to a time-of-check time-of-use issue in ACPI device. A malicious actor with administrative access to a virtual machine may be able to exploit this vulnerability to crash the virtual machine's vmx process or corrupt hypervisor's memory heap.
Weaknesses (CWE)
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.7 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 4.9 | AV:N/AC:M/Au:S/C:N/I:P/A:P | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2020-25247
- GCVE · GCVE-0-2020-3982
CERT-FR advisories
- CERTFR-2020-AVI-658 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:vmware:esxi:7.0.0:-:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:7.0.0:1.20.16321839:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:-:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201806001:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201807001:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201808001:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810001:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810101:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810102:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810103:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810201:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810202:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810203:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810204:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810205:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810206:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810207:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810208:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810209:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810210:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810211:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810212:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810213:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810214:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810215:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810216:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810217:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810218:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810219:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810220:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810221:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810222:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810223:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810224:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810225:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810226:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810227:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810228:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810229:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810230:*:*:*:*:*:*- +185 more
Affected products
| Product | Versions |
|---|---|
| VMware ESXi, Workstation, Fusion | affected VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202008101-SG, 6.5 before ESXi650-202007101-SG), Workstation (15.x), Fusion (11.x before 11.5.6) |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |