KLA11173 OSI vulnerability in VMware Products

A bounds check bypass and branch target injection vulnerability was found in VMware ESXi, VMWare Workstation and VMware Fusion. By exploiting this vulnerability malicious users can obtain sensitive information.

Original advisories

VMSA-2018-0004

VMSA-2018-0002

Exploitation

Public exploits exist for this vulnerability.

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

VMware-Workstation

VMware-Fusion

CVE list

CVE-2017-5715 high

CVE-2017-5753 high

Solution

Update to latest versionDownload VMware Workstation Pro

Download VMware Fusion

Impacts

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

Affected Products

• VMware Workstation 12.x earlier than 12.5.8VMware Workstation 14.x earlier than 14.1.1VMware Fusion earlier than 8.5.10ESXi 6.5 earlier than ESXi550-201801401-BGESXi 6.0 earlier than ESXi600-201711402-SGESXi 5.5 earlier than ESXi550-201801402-BG