CVE-2020-3969 Memory corruption in Fusion

High 7.8 Published 24 Jun 2020 Updated 4 Aug 2024

A local attacker in a VM with 3D graphics enabled can exploit a heap overflow to execute code on the hypervisor, requiring specific conditions.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-3969?

CVE-2020-3969 is a high-severity memory corruption vulnerability in Vmware Cloud Foundation, published on 24 Jun 2020. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.5), and Fusion (11.x before 11.5.5) contain an off-by-one heap-overflow vulnerability in the SVGA device. A malicious actor with local access to a virtual machine with 3D graphics enabled may be able to exploit this vulnerability to execute code on the hypervisor from a virtual machine. Additional conditions beyond the attacker's control must be present for exploitation to be possible.

Weakness: CWE-193

Which versions are affected by CVE-2020-3969?

It affects 4 products.

Products include Vmware Cloud Foundation, Vmware Esxi, Vmware Fusion, Vmware Workstation.

How do I fix CVE-2020-3969?

No fix has been published for CVE-2020-3969 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2020-3969 being exploited?

There is no known exploitation of CVE-2020-3969 in the wild and no public exploit code.

All Vmware Cloud Foundation vulnerabilities

Sources

Also known as GHSA-mg53-f77r-h6c2.