Vulnerabilities > CVE-2020-3960 - Out-of-bounds Read vulnerability in VMWare Fusion, Vsphere Esxi and Workstation
Attack vector
LOCAL Attack complexity
LOW Privileges required
LOW Confidentiality impact
HIGH Integrity impact
NONE Availability impact
HIGH Summary
VMware ESXi (6.7 before ESXi670-202006401-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.5), and Fusion (11.x before 11.5.5) contain an out-of-bounds read vulnerability in NVMe functionality. A malicious actor with local non-administrative access to a virtual machine with a virtual NVMe controller present may be able to read privileged information contained in physical memory.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Overread Buffers An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.
Nessus
NASL family | VMware ESX Local Security Checks |
NASL id | VMWARE_VMSA-2020-0012.NASL |
description | a. VMware ESXi, Workstation and Fusion out-of-bounds read vulnerability (CVE-2020-3960) Description : VMware ESXi, Workstation and Fusion contain an out-of-bounds read vulnerability in NVMe functionality. A malicious actor with local non-administrative access to a virtual machine may be able to read privileged information contained in memory. |
last seen | 2020-06-12 |
modified | 2020-06-11 |
plugin id | 137354 |
published | 2020-06-11 |
reporter | This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. |
source | https://www.tenable.com/plugins/nessus/137354 |
title | VMSA-2020-0012 : VMware ESXi, Workstation and Fusion updates address out-of-bounds read vulnerability |
code |
|