VMSA-2013-0002 : VMware ESX, Workstation, Fusion, and View VMCI privilege escalation vulnerability

high Nessus Plugin ID 64643

Language:

Synopsis

The remote VMware ESXi / ESX host is missing a security-related patch.

Description

a. VMware VMCI privilege escalation

VMware ESX, Workstation, Fusion, and View contain a vulnerability in the handling of control code in vmci.sys.
A local malicious user may exploit this vulnerability to manipulate the memory allocation through the Virtual Machine Communication Interface (VMCI) code. This could result in a privilege escalation on Windows-based hosts and on Windows-based Guest Operating Systems.

The vulnerability does not allow for privilege escalation from the Guest Operating System to the host (and vice versa).
This means that host memory can not be manipulated from the Guest Operating System (and vice versa).

Systems that have VMCI disabled are also affected by this issue.

VMware would like to thank Derek Soeder of Cylance, Inc. and Kostya Kortchinsky of Microsoft for independently reporting this issue to us.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2013-1406 to this issue.

Solution

Apply the missing patch.

Plugin Details

Severity: High

ID: 64643

File Name: vmware_VMSA-2013-0002.nasl

Version: 1.10

Type: local

Family: VMware ESX Local Security Checks

Published: 2/16/2013

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 6

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: cpe:/o:vmware:esx:4.0, cpe:/o:vmware:esxi:4.0, cpe:/o:vmware:esxi:5.0, cpe:/o:vmware:esxi:5.1

Required KB Items: Host/local_checks_enabled, Host/VMware/release, Host/VMware/version

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2/7/2013

Exploitable With

Core Impact

Reference Information

CVE: CVE-2013-1406

BID: 57867

VMSA: 2013-0002

Detections

Analytics