Allele Security Alert
ASA-2018-00041
Identifier(s)
ASA-2018-00041, CVE-2018-6982, VMSA-2018-0027
Title
vmxnet3 uninitialized stack memory usage
Vendor(s)
VMware
Product(s)
VMware vSphere ESXi (ESXi)
VMware Workstation Pro / Player (Workstation)
VMware Fusion Pro / Fusion (Fusion)
Affected version(s)
ESXi 6.7
ESXi 6.5
ESXi 6.0
Workstation 15.x
Workstation 14.x
Fusion 11.x
Fusion 10.x
Fixed version(s)
ESXi 6.7 Patch Release ESXi670-201811401-BG
ESXi 6.5 Patch Release ESXi650-201811301-BG
ESXi 6.0 Patch Release ESXi600-201811401-BG
Workstation 15.0.1
Workstation 14.1.4
Fusion 11.0.1
Fusion 10.1.4
Proof of concept
Unknown
Description
VMware ESXi, Fusion and Workstation contain uninitialized stack memory usage in the vmxnet3 virtual network adapter. This issue may allow a guest to execute code on the host. The issue is present if vmxnet3 is enabled. Non vmxnet3 virtual adapters are not affected by this issue.
Technical details
Unknown
Credits
Zhangyanyu (Chaitin Tech)
Reference(s)
NEW VMSA-2018-0027 VMware ESXi, Workstation, and Fusion updates address uninitialized stack memory usage
https://seclists.org/bugtraq/2018/Nov/12
VMware ESXi 6.7, Patch Release ESXi670-201811001
https://docs.vmware.com/en/VMware-vSphere/6.7/rn/esxi670-201811001.html
VMware ESXi 6.5, Patch Release ESXi650-201811001
https://docs.vmware.com/en/VMware-vSphere/6.5/rn/esxi650-201811001.html
VMware ESXi 6.0, Patch Release ESXi600-201811001
https://docs.vmware.com/en/VMware-vSphere/6.0/rn/esxi600-201811001.html
[Security-announce] New VMSA-2018-0027 – VMware ESXi, Workstation, and Fusion updates address uninitialized stack memory usage
https://lists.vmware.com/pipermail/security-announce/2018/000441.html
VMSA-2018-0027
https://www.vmware.com/security/advisories/VMSA-2018-0027.html
CVE-2018-6982
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6982
CVE-2018-6982
https://nvd.nist.gov/vuln/detail/CVE-2018-6982
If there is any error in this alert or you wish a comprehensive analysis, let us know.
Last modified: February 1, 2019