Description
VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi600-201703403-SG, 6.0 U1 without patch ESXi600-201703402-SG, 5.5 without patch ESXi550-201703401-SG; Workstation Pro / Player 12.x prior to 12.5.5; and Fusion Pro / Fusion 8.x prior to 8.5.6 have uninitialized memory usage. This issue may lead to an information leak.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| VMware | ESXi | 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi600-201703403-SG, 6.0 U1 without patch ESXi600-201703402-SG, 5.5 without patch ESXi550-201703401-SG | — |
| VMware | Workstation Pro / Player | 12.x prior to 12.5.5 | — |
| VMware | Fusion Pro / Fusion | 8.x prior to 8.5.6 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- VMware WorkStation 12.5.3 - Virtual Machine Escape EDB-47715 · local · Jun 6, 2019
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 97164 vdb-entry
- http://www.vmware.com/security/advisories/VMSA-2017-0006.html
- 1038148 vdb-entry
- 1038149 vdb-entry