VMware ESXi (6.7 before ESXi670-201904101-SG and 6.5 before ESXi650-201903001), Workstation (15.x before 15.0.3 and 14.x before 14.1.6), Fusion (11.x before 11.0.3 and 10.x before 10.1.6) updates address an out-of-bounds vulnerability with the vertex shader functionality. Exploitation of this issue requires an attacker to have access to a virtual machine with 3D graphics enabled. Successful exploitation of this issue may lead to information disclosure or may allow attackers with normal user privileges to create a denial-of-service condition on their own VM. The workaround for this issue involves disabling the 3D-acceleration feature. This feature is not enabled by default on ESXi and is enabled by default on Workstation and Fusion.

The remote VMware ESXi host is version 6.5 or 6.7 and is missing a security patch. It is, therefore, vulnerable to multiple vulnerabilities, including:

  - An out-of-bounds read vulnerability exists in the vertex     shader component of the 3D-acceleration feature could     allow an authenticated attacker to disclose sensitive     information or cause a denial-of-service of the guest     virtual machine. (CVE-2019-5516)

  - An out-of-bounds read vulnerability exists in the shader     translator component of the 3D-acceleration feature could     allow an authenticated attacker to disclose sensitive     information or cause a denial-of-service of the guest     virtual machine. (CVE-2019-5517)

  - An out-of-bounds read vulnerability in the     3D-acceleration feature could allow an authenticated     attacker to disclose sensitive information.
    (CVE-2019-5520)

Note virtual machines must be configured with the 3D-acceleration enabled. VMware ESXi defaults to this feature not being enabled.

The version of VMware Fusion installed on the remote macOS or Mac OS X host is 10.x prior to 10.1.6 or 11.x prior to 11.0.3. It is, therefore, affected by multiple vulnerabilities, including:

  - An out-of-bounds read vulnerability exists in the vertex     shader component of the 3D-acceleration feature could     allow an authenticated attacker to disclose sensitive     information or cause a denial-of-service of the guest     virtual machine. (CVE-2019-5516)

  - An out-of-bounds read vulnerability exists in the shader     translator component of the 3D-acceleration feature could     allow an authenticated attacker to disclose sensitive     information or cause a denial-of-service of the guest     virtual machine. (CVE-2019-5517)

  - An out-of-bounds read vulnerability in the     3D-acceleration feature could allow an authenticated     attacker to disclose sensitive information.
    (CVE-2019-5520)

Note virtual machines must be configured with the 3D-acceleration enabled. VMware Fusion defaults to this feature being enabled.

The version of VMware Workstation installed on the remote host is 14.x prior to 14.1.6 or 15.x prior to 15.0.3. It is, therefore, affected by multiple vulnerabilities :

  - An out-of-bounds read vulnerability exists in the vertex     shader component of the 3D-acceleration feature could     allow an authenticated attacker to disclose sensitive     information or cause a denial-of-service of the guest     virtual machine. (CVE-2019-5516)

  - An out-of-bounds read vulnerability exists in the shader     translator component of the 3D-acceleration feature could     allow an authenticated attacker to disclose sensitive     information or cause a denial-of-service of the guest     virtual machine. (CVE-2019-5517)

  - An out-of-bounds read vulnerability in the     3D-acceleration feature could allow an authenticated     attacker to disclose sensitive information.
    (CVE-2019-5520)

Note virtual machines must be configured with the 3D-acceleration enabled. VMware Workstation defaults to this feature being enabled.

a. VMware ESXi, Workstation and Fusion vertex shader out-of-bounds read    vulnerability

  VMware ESXi, Workstation and Fusion updates address an out-of-bounds   vulnerability with the vertex shader functionality.  Exploitation of   this issue requires an attacker to have access to a virtual machine   with 3D graphics enabled.  Successful exploitation of this issue may   lead to information disclosure or may allow attackers with normal   user privileges to create a denial-of-service condition on their own   VM.  The workaround for this issue involves disabling the   3D-acceleration feature. This feature is not enabled by default on   ESXi and is enabled by default on Workstation and Fusion.
    VMware would like to thank Piotr Bania of Cisco Talos for reporting   this issue to us.
    The Common Vulnerabilities and Exposures project (cve.mitre.org) has   assigned the identifier CVE-2019-5516 to this issue.

b. VMware ESXi, Workstation and Fusion multiple shader translator    out-of-bounds read vulnerabilities

  VMware ESXi, Workstation and Fusion contain multiple out-of-bounds   read vulnerabilities in the shader translator. Exploitation of these   issues requires an attacker to have access to a virtual machine with   3D graphics enabled.  Successful exploitation of these issues may   lead to information disclosure or may allow attackers with normal   user privileges to create a denial-of-service condition on their own   VM.  The workaround for these issues involves disabling the   3D-acceleration feature.  This feature is not enabled by default on   ESXi and is enabled by default on Workstation and Fusion.

  VMware would like to thank RanchoIce of Tencent Security ZhanluLab   for reporting these issues to us.

  The Common Vulnerabilities and Exposures project (cve.mitre.org) has   assigned the identifier CVE-2019-5517 to these issues.

c. VMware ESXi, Workstation and Fusion out-of-bounds read    vulnerability

  VMware ESXi, Workstation and Fusion updates address an out-of-bounds   read vulnerability.  Exploitation of this issue requires an attacker   to have access to a virtual machine with 3D graphics enabled.
  Successful exploitation of this issue may lead to information   disclosure. The workaround for this issue involves disabling the   3D-acceleration feature. This feature is not enabled by default on   ESXi and is enabled by default on Workstation and Fusion.

  VMware would like to thank instructor working with Trend Micro's   Zero Day Initiative for reporting this issue to us.

  The Common Vulnerabilities and Exposures project (cve.mitre.org) has   assigned the identifier CVE-2019-5520 to this issue.

ID	Name	Product	Family	Severity
124300	ESXi 6.5 / 6.7 Multiple Vulnerabilities (VMSA-2019-0006) (Remote Check)	Nessus	Misc.	medium
124299	VMware Fusion 10.x < 10.1.6 / 11.x < 11.0.3 Multiple Vulnerabilities (VMSA-2019-0005) (macOS)	Nessus	MacOS X Local Security Checks	medium
124298	VMware Workstation 14.x < 14.1.6 / 15.x < 15.0.3 Multiple Vulnerabilities (VMSA-2019-0006)	Nessus	General	medium
124192	VMSA-2019-0006 : VMware ESXi, Workstation and Fusion updates address multiple out-of-bounds read vulnerabilities	Nessus	VMware ESX Local Security Checks	medium

Detections

Analytics

CVE-2019-5516

medium

Tenable Plugins

medium

medium

medium

medium