CVE-2020-3950 VMware Multiple Products Privilege Escalation
Attackers with normal user privileges can escalate to root on systems running VMware Fusion, VMRC, or Horizon Client for Mac due to improper setuid binary usage.
- Exploited in the wild
- Since 3 Nov 2021
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-3950?
CVE-2020-3950 is a high-severity vulnerability in Vmware Fusion, published on 17 Mar 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0) contain a privilege escalation vulnerability due to improper use of setuid binaries. Successful exploitation of this issue may allow attackers with normal user privileges to escalate their privileges to root on the system where Fusion, VMRC or Horizon Client is installed.
Weakness: CWE-269
Which versions are affected by CVE-2020-3950?
It affects 3 products.
Products include Vmware Fusion, Vmware Horizon Client, Vmware Remote Console.
How do I fix CVE-2020-3950?
No fix has been published for CVE-2020-3950 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 3 May 2022.
Is CVE-2020-3950 being exploited?
Yes. Attackers have exploited CVE-2020-3950 in the wild since at least 3 Nov 2021.
Public exploit code: 1 Metasploit module and 3 Exploit-DB entries.
Other vulnerabilities in Vmware Fusion
- CVE-2017-4901 Memory corruption in Fusion Pro / Fusion
- CVE-2024-22267 Use after free in VMware Fusion
- CVE-2019-5541 Memory corruption in Workstation and Fusion
- CVE-2024-38811 Code-execution vulnerability
- CVE-2023-20872 Memory corruption in VMware Workstation Pro / Player (Workstation) and VMware Fusion
Sources
Also known as GHSA-fx3w-hj7j-hfgf.