Data Centre

Virtualization

Video nasty lets VMware guests run code on hosts

It's 2017 and SVGA device can p0wn enterprise software. Sigh

By Simon Sharwood, APAC Editor

14 SHARE

VMware's given vAdmins a busy Friday by disclosing three nasties to patch.

One's a video nasty dubbed CVE-2017-4924 and impacts VMware ESXi, and the desktop hypervisors Workstation & Fusion. This one's “an out-of-bounds write vulnerability in SVGA driver device*” , an old virtual graphics card toolkit. The bug “may allow a guest to execute code on the host.”

There's a critical patch for ESXi 6.5, and a call to upgrade Workstation 12.x to version 12.5.7. Fusion 8.x users should get to version 8.5.8 as a matter of urgency. ESXi 6.0 and 5.5 don't have the problem.

The three products also have a NULL pointer dereference vulnerability that “occurs when handling guest RPC requests” and “may allow attackers with normal user privileges to crash their VMs.” This one's graded “moderate” and effects ESXi 5.5 through 6.5, plus Workstation 12.x and Fusion 8.x. Check out CVE-2017-4925 for details, once they land.

vCenter Server users also have something to worry about, as version 6.5 has a moderate bug that “may allow for stored cross-site scripting” as “An attacker with VC user privileges can inject malicious java-scripts which will get executed when other VC users access the page.”

Version 6.5 U1 squashes the bug. ®

* That's VMware's mistake we've struck out - Security Advisory VMSA-2017-0015 received a .1 upgrade to correct the error.

Sign up to our NewsletterGet IT in your inbox daily

14 Comments

More from The Register

VMware's GM for networking and security jumps to Google

Veteran Jeff Jennings to get the band back together with VMware founder Diane Greene

Google, VMware and Pivotal team for on-premises Kubernetes

VMworld 2017 Apparently some of you want to cuddle containers

Xen Project patches Intel’s Lazy FPU flaw, VMware doesn't need to

UPDATE Guest register states are readable, but the patch cavalry has arrived

Desktop hypervisor fiends. Both of you. VMware's testing a new cut of Workstation

Complete with a REST API for automated amusement

Slick HCI trick: VMware smooths off vSAN's rough edges

Wants to hang on to sales dominance

VMware set to reveal blockchain, better app store, new AWS client

VMworld content catalogues are live and we’ve trawled ‘em

VMware vids revealing new vSphere vanish

Blink and you’ll have what missed what looks like a premature promo release

VMware ponders baking backup into VSAN

And disaster recovery too, by painting a target on AWS

VMware to finally deliver full-function HTML5 vSphere client

It’ll only have been two-and-a-half years from launch to landing

Beware VMware! Nutanix sprays all over Virtzilla's networking territory

Teases FLOW product as alternative to NSX