CVE-2020-3968 Memory corruption in Fusion

High 8.2 Published 25 Jun 2020 Updated 4 Aug 2024

A local attacker with admin privileges in a VM can exploit an out-of-bounds write in the USB controller to crash the VM or execute code on the hypervisor.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-3968?

CVE-2020-3968 is a high-severity memory corruption vulnerability in Vmware Cloud Foundation, published on 25 Jun 2020. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.5), and Fusion (11.x before 11.5.5) contain an out-of-bounds write vulnerability in the USB 3.0 controller (xHCI). A malicious actor with local administrative privileges on a virtual machine may be able to exploit this issue to crash the virtual machine's vmx process leading to a denial of service condition or execute code on the hypervisor from a virtual machine. Additional conditions beyond the attacker's control must be present for exploitation to be possible.

Weakness: CWE-787

Which versions are affected by CVE-2020-3968?

It affects 4 products.

Products include Vmware Cloud Foundation, Vmware Esxi, Vmware Fusion, Vmware Workstation.

How do I fix CVE-2020-3968?

No fix has been published for CVE-2020-3968 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2020-3968 being exploited?

There is no known exploitation of CVE-2020-3968 in the wild and no public exploit code.

All Vmware Cloud Foundation vulnerabilities

Sources

Also known as GHSA-h4rr-vfvf-xcpv.