CVE-2017-4904 The XHCI controller in VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi600-201703403-SG, 6.0 U1 without patch ESXi600-201703402-...
HighCVSS 8.8
EPSS 0.43%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The XHCI controller in VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi600-201703403-SG, 6.0 U1 without patch ESXi600-201703402-SG, and 5.5 without patch ESXi550-201703401-SG; Workstation Pro / Player 12.x prior to 12.5.5; and Fusion Pro / Fusion 8.x prior to 8.5.6 has uninitialized memory usage. This issue may allow a guest to execute code on the host. The issue is reduced to a Denial of Service of the guest on ESXi 5.5.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| VMware Fusion | >= 8.0.0, < 8.5.6 | 8.5.6 |
| VMware fusion pro | >= 8.0.0, < 8.5.6 | 8.5.6 |
| VMware workstation player | >= 12.0.0, < 12.5.5 | 12.5.5 |
| VMware workstation pro | >= 12.0.0, < 12.5.5 | 12.5.5 |
| VMware esxi | = 5.5 | No fix listed |
| VMware esxi | = 5.5-1 | No fix listed |
| VMware esxi | = 5.5-2 | No fix listed |
| VMware esxi | = 5.5-3a | No fix listed |
| VMware esxi | = 5.5-3b | No fix listed |
| VMware esxi | = 6.0 | No fix listed |
| VMware esxi | = 6.0-1 | No fix listed |
| VMware esxi | = 6.0-1a | No fix listed |
| VMware esxi | = 6.0-1b | No fix listed |
| VMware esxi | = 6.0-2 | No fix listed |
| VMware esxi | = 6.0-3 | No fix listed |
| VMware esxi | = 6.0-3a | No fix listed |
| VMware esxi | = 6.5 | No fix listed |
| VMware esxi | = 6.5 without patch ESXi650-201703410-SG | No fix listed |
| VMware esxi | = 6.0 U3 without patch ESXi600-201703401-SG | No fix listed |
| VMware esxi | = 6.0 U2 without patch ESXi600-201703403-SG | No fix listed |
| VMware esxi | = 6.0 U1 without patch ESXi600-201703402-SG | No fix listed |
| VMware esxi | = 5.5 without patch ESXi550-201703401-SG | No fix listed |
| VMware Workstation Pro / Player | = 12.x prior to 12.5.5 | No fix listed |
| VMware Fusion Pro / Fusion | = 8.x prior to 8.5.6 | No fix listed |
References
- 97165 third-party-advisory vdb-entry
- 1038148 third-party-advisory vdb-entry
- 1038149 third-party-advisory vdb-entry
- www.vmware.com vendor-advisory