Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2020.1995
VMSA-2020-0012 - VMware ESXi, Workstation and Fusion updates
address out-of-bounds read vulnerability
10 June 2020
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: VMware vSphere ESXi (ESXi)
VMware Workstation Pro / Player (Workstation)
VMware Fusion Pro / Fusion (Fusion)
Publisher: VMWare
Operating System: Windows
UNIX variants (UNIX, Linux, OSX)
Virtualisation
Impact/Access: Access Confidential Data -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2020-3960
Original Bulletin:
https://www.vmware.com/security/advisories/VMSA-2020-0012.html
- --------------------------BEGIN INCLUDED TEXT--------------------
Advisory ID: VMSA-2020-0012
CVSSv3 Range: 7.1
Issue Date: 2020-06-09
Updated On: 2020-06-09 (Initial Advisory)
CVE(s): CVE-2020-3960
Synopsis: VMware ESXi, Workstation and Fusion updates address out-of-bounds
read vulnerability (CVE-2020-3960)
1. Impacted Products
o VMware vSphere ESXi (ESXi)
o VMware Workstation Pro / Player (Workstation)
o VMware Fusion Pro / Fusion (Fusion)
2. Introduction
An out-of-bounds read vulnerability affecting VMware hypervisors was privately
reported to VMware. Updates are available to address this vulnerability in
affected VMware products.
3. VMware ESXi, Workstation and Fusion out-of-bounds read vulnerability
(CVE-2020-3960)
Description
VMware ESXi, Workstation and Fusion contain an out-of-bounds read vulnerability
in NVMe functionality. VMware has evaluated the severity of this issue to be in
the Important severity range with a maximum CVSSv3 base score of 7.1.
Known Attack Vendors
A malicious actor with local non-administrative access to a virtual machine may
be able to read privileged information contained in memory.
Resolution
To remediate CVE-2020-3960 apply the patches listed in the 'Fixed Version'
column of the 'Response Matrix' below.
Workarounds
None.
Additional Documentation
None.
Notes
None.
Acknowledgements
VMware would like to thank Cfir Cohen of Google Cloud security for reporting
this issue to us.
Response Matrix
Product Version Running CVE CVSSv3 Severity Fixed Version Workarounds Additional
On Identifier Documentation
ESXi 7.0 Any CVE-2020-3960 N/A N/A Unaffected N/A N/A
ESXi 6.7 Any CVE-2020-3960 7.1 ESXi670-202006401-SG None None
important
ESXi 6.5 Any CVE-2020-3960 7.1 ESXi650-202005401-SG None None
important
Workstation 15.x Any CVE-2020-3960 7.1 15.5.5 None None
important
Fusion 11.x Any CVE-2020-3960 7.1 11.5.5 None None
important
4. References
ESXi 6.7 Patch ESXi670-202006401-SG
https://my.vmware.com/group/vmware/patch
https://docs.vmware.com/en/VMware-vSphere/6.7/rn/esxi670-202006001.html#
esxi670-202006401-sg-resolved
ESXi 6.5 Patch ESXi650-202005401-SG
https://my.vmware.com/group/vmware/patch
https://docs.vmware.com/en/VMware-vSphere/6.5/rn/esxi650-202005001.html#
esxi650-202005401-sg-resolved
VMware Workstation Pro 15.5.5
https://www.vmware.com/go/downloadworkstation
https://docs.vmware.com/en/VMware-Workstation-Pro/index.html
VMware Fusion 11.5.5
https://www.vmware.com/go/downloadfusion
https://docs.vmware.com/en/VMware-Fusion/index.html
Mitre CVE Dictionary Links:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-3960
FIRST CVSSv3 Calculator:
https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/
I:N/A:N
5. Change Log
2020-06-09 VMSA-2020-0012
Initial security advisory.
6. Contact
E-mail list for product security notifications and announcements:
https://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
security-announce@lists.vmware.com
E-mail:
security@vmware.com
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXuA4j+NLKJtyKPYoAQjQeRAAnM29pDVFkTd/PhJI2oBQaQXXTYrq/Exf
0TtsYNztowQVSs4yxbEhCi9stoHeO2y8uJtEL4lNMADnb6i5ePh718zxppATdQqX
CpeeOYXWNO50Nn4gtyEHepkHKptZkL87oaMIwQ2E5xnDvbCuz+d63MfW4LGcqWLL
QV+Lby6yO7/1llORx/pZ1Kmm3ZTPtV+kx0n24KofaaLe1C9QCB5qwaa13aO2N+EU
5SSHfVCdROGrF+SQ1jK/qDcf2UXZW38qQGN4uyCHMwhoeylyHvnxZGrYgJZUMplu
HbIV9nHNzShxHUohCPwT1dHnVVMC+FIQGtxHb4BmxvrqOBeRBmsLBNRogY7o92BK
X91y0AVEruzXwxaLpppYQhcvpABz3Rg+uMumXKqx2NPaezM3U+9IMfIx0c7lMi4g
DqeNnhK+g14mRwddnvUQl3IwwVyxYzkup85X/YL1n1Q46ilxk0bQsN0g8YUUuvGi
hBfrtN27G+jj/R/08z2yvZQAR/gZR5OP67/3MnhokLQ0Fzw0v6RDKEag5QPj87Wa
2NWKrJc7br5/G7t7HMdBqAzJnVaU3bZUKORNy8N0MpB/2FsVlZA335Pfs4h36WSp
5KLgKE8a95bj/zYBIvA8dEsJaj+QUYghOdGxuawzFWfU03v1a7aRtjy9hpPadDar
pY2bdyQny5Q=
=ctUc
-----END PGP SIGNATURE-----