Video nasty lets VMware guests run code on hosts

VMware's given vAdmins a busy Friday by disclosing three nasties to patch.

One's a video nasty dubbed CVE-2017-4924 and impacts VMware ESXi, and the desktop hypervisors Workstation & Fusion. This one's “an out-of-bounds write vulnerability in SVGA driver device^*” , an old virtual graphics card toolkit. The bug “may allow a guest to execute code on the host.”

There's a critical patch for ESXi 6.5, and a call to upgrade Workstation 12.x to version 12.5.7. Fusion 8.x users should get to version 8.5.8 as a matter of urgency. ESXi 6.0 and 5.5 don't have the problem.

The three products also have a NULL pointer dereference vulnerability that “occurs when handling guest RPC requests” and “may allow attackers with normal user privileges to crash their VMs.” This one's graded “moderate” and effects ESXi 5.5 through 6.5, plus Workstation 12.x and Fusion 8.x. Check out CVE-2017-4925 for details, once they land.

vCenter Server users also have something to worry about, as version 6.5 has a moderate bug that “may allow for stored cross-site scripting” as “An attacker with VC user privileges can inject malicious java-scripts which will get executed when other VC users access the page.”

Version 6.5 U1 squashes the bug. ®

^* That's VMware's mistake we've struck out - Security Advisory VMSA-2017-0015 received a .1 upgrade to correct the error.