Video nasty lets VMware guests run code on hosts

It's 2017 and SVGA device can p0wn enterprise software. Sigh

By Simon Sharwood, APAC Editor

Posted in Virtualization, 15th September 2017 08:30 GMT

VMware's given vAdmins a busy Friday by disclosing three nasties to patch.

One's a video nasty dubbed CVE-2017-4924 and impacts VMware ESXi, and the desktop hypervisors Workstation & Fusion. This one's “an out-of-bounds write vulnerability in SVGA driver device*” , an old virtual graphics card toolkit. The bug “may allow a guest to execute code on the host.”

There's a critical patch for ESXi 6.5, and a call to upgrade Workstation 12.x to version 12.5.7. Fusion 8.x users should get to version 8.5.8 as a matter of urgency. ESXi 6.0 and 5.5 don't have the problem.

The three products also have a NULL pointer dereference vulnerability that “occurs when handling guest RPC requests” and “may allow attackers with normal user privileges to crash their VMs.” This one's graded “moderate” and effects ESXi 5.5 through 6.5, plus Workstation 12.x and Fusion 8.x. Check out CVE-2017-4925 for details, once they land.

vCenter Server users also have something to worry about, as version 6.5 has a moderate bug that “may allow for stored cross-site scripting” as “An attacker with VC user privileges can inject malicious java-scripts which will get executed when other VC users access the page.”

Version 6.5 U1 squashes the bug. ®

* That's VMware's mistake we've struck out - Security Advisory VMSA-2017-0015 received a .1 upgrade to correct the error.

Sign up to our NewsletterGet IT in your inbox daily

14 Comments

More from The Register

VMware's GM for networking and security jumps to Google

Veteran Jeff Jennings to get the band back together with VMware founder Diane Greene

Google, VMware and Pivotal team for on-premises Kubernetes

VMworld 2017 Apparently some of you want to cuddle containers

Slick HCI trick: VMware smooths off vSAN's rough edges

Wants to hang on to sales dominance

VMware vids revealing new vSphere vanish

Blink and you’ll have what missed what looks like a premature promo release

VMware ponders baking backup into VSAN

And disaster recovery too, by painting a target on AWS

Beware VMware! Nutanix sprays all over Virtzilla's networking territory

Teases FLOW product as alternative to NSX

Dell sell-off saga gets weird: Subsidiary VMware may buy parent in 'reverse merger'

Buy-out would let Big Mike swerve IPO headaches

Roses are red, violets are blue, VMware's made a new vSphere for you

Version 6.7 should land in Q2, may end support for older CPUs

Forking hell! VMware now has TWO current versions of vSphere

One for vSphere veterans, one for hybrid hipsters, plus a security surprise