Home > Blogs > VMware Security & Compliance Blog

VMware Security Advisory: VMSA-2018-0018

Today VMware has released the following new and updated security advisories:

VMSA-2018-0018

Please sign up to the Security-Announce mailing list to receive new and updated VMware Security Advisories.

Customers should review the security advisories and direct any questions to VMware Support.

New VMware Security Advisory VMSA-2018-0017

Today, VMware has released the following new security advisory:

VMSA-2018-0017VMware Tools update addresses an out-of-bounds read vulnerability

This documents the remediation of an important severity out-of-bounds read vulnerability (CVE-2018-6969) in VMware Tools. Successful exploitation of this issue may lead to information disclosure or may allow attackers to escalate their privileges on the guest VMs. File sharing must be enabled to be able to exploit this issue.

VMware Tools 10.x and prior versions are affected. This issue has been addressed in VMware Tools 10.3.0.

We would like to thank Anurudh for reporting this issue to us.

Please sign up to the Security-Announce mailing list to receive new and updated VMware Security Advisories.

Customers should review the security advisories and direct any questions to VMware Support.

New VMware Security Advisory VMSA-2018-0016 and updated advisories VMSA-2018-0011.1, VMSA-2018-0012.1

Today VMware has released the following new and updated security advisories:

VMSA-2018-0016 – VMware ESXi, and Workstation updates address multiple out-of-bounds read vulnerabilities.
VMSA-2018-0012.1 – VMware vSphere, Workstation and Fusion updates enable Hypervisor-Assisted Guest Mitigations for Speculative Store
VMSA-2018-0011.1 – Unauthenticated Command Injection vulnerability in VMware NSX SD-WAN by VeloCloud

VMSA-2018-0016 documents out-of-bound read issues in the shader translator of ESXi, Workstation and Fusion. These issues have severity important since they may lead to denial of service of the VM or to information disclosure.
VMware would like to thank RanchoIce of Tencent ZhanluLab (CVE-2018-6965, CVE-2018-6966, CVE-2018-6967) and a member of Cisco Talos (CVE-2018-6965) for independently reporting these issues to us.

VMSA-2018-0012.1 notes:

  • Hypervisor-Assisted Guest Mitigations for the Speculative-Store-Bypass issue (CVE-2018-3639) are now available since Intel has provided the required microcodes. The ESXi Knowledge Base articles found in the advisory list which microcodes are available from the ESXi patches.
  • The vCenter Server updates and ESXi patches in combination with the Intel microcode will make the Speculative-Store-Bypass-Disable (SSBD) control bit available to guest operating systems.
  • OS vendor patches that take advantage of SSBD will need to be deployed as well. OS Vendors typically do not enable SSBD by default. Consult your OS Vendor patch documentation for this.
  • The full steps needed to apply the Hypervisor-Assisted Guest Mitigations for CVE-2018-3639 are explained in VMware Knowledge Base article 55111 while VMware Knowledge Base article 54951 provides more background.
  • The initial release of VMSA-2018-0012 was discussed in an earlier blog post.

VMSA-2018-0011.1 was issued to correct the affected version.

Please sign up to the Security-Announce mailing list to receive new and updated VMware Security Advisories.

VMSA-2018-0015

Today VMware has released the following new and updated security advisories:

VMSA-2018-0015 – https://www.vmware.com/security/advisories/VMSA-2018-0015.html

Please sign up to the Security-Announce mailing list to receive new and updated VMware Security Advisories.

Customers should review the security advisories and direct any questions to VMware Support.

New VMware Security Advisory VMSA-2018-0014

Today VMware has released the following new security advisory:

VMSA-2018-0014VMware Horizon Client update addresses a privilege escalation vulnerability

This documents the remediation of an important severity local privilege escalation
vulnerability (CVE-2018-6964) in VMware Horizon Client for Linux. Successful exploitation of this issue may allow unprivileged users to escalate their privileges to root on a Linux machine where Horizon Client is installed.

VMware Horizon Client for Linux 4.x and prior versions are affected. This issue has been addressed in VMware Horizon Client for Linux 4.8.0.

We would like to thank Nassim Abbaoui, pentester at OVH, for reporting this issue to us.

Please sign up to the Security-Announce mailing list to receive new and updated VMware Security Advisories.

Customers should review the security advisories and direct any questions to VMware Support.

New VMware Security Advisory VMSA-2018-0013

Today, VMware has released the following new security advisory:

VMSA-2018-0013VMware Workstation and Fusion updates address signature bypass and multiple denial-of-service vulnerabilities

This documents the remediation of an important severity issue (CVE-2018-6962) in VMware Fusion and moderate severity issues (CVE-2018-6963) in VMware Workstation and Fusion.

Issue (a) CVE-2018-6962 is signature bypass vulnerability which may lead to a local privilege escalation. This issue has been addressed in VMware Fusion 10.1.2.

Issue (b) CVE-2018-6963 is multiple denial-of-service vulnerabilities in the RPC handler. Exploitation of these issues may allow an attacker with limited privileges on the guest machine trigger a denial-of-service of their guest machine. These issue have been addressed in VMware Workstation 14.1.2 and Fusion 10.1.2.

We would like to thank CodeColorist of AntFinancial LightYear Security Labs, Hahna Latonick and Kevin Fujimoto working with Trend Micro’s Zero Day Initiative, and Bruno Botelho (@utxsec) for reporting these issues to us.

Please sign up to the Security-Announce mailing list to receive new and updated VMware Security Advisories.

Customers should review the security advisories and direct any questions to VMware Support.

VMSA-2018-0012

Greetings from the VMware Security Response Center!

Today we released VMSA-2018-0012 which documents Hypervisor-Assisted Guest Mitigations for CVE-2018-3639 (Speculative Store Bypass). In addition CVE-2018-3640 (Rogue System Register Read) was also disclosed today.

We thought a few points and a documentation summary would be in order to help sum up what this issue means for VMware products:

CVE-2018-3639

The issue requires Hypervisor-Assisted Guest Mitigations for vSphere to pass the new Speculative-Store-Bypass-Disable (SSBD) control bit to guest operating systems, it has been classified as Moderate severity. ESXi and vCenter updates will be required.
Microcode containing the SSBD control bits are not yet available from 3rd parties so vSphere patches are on hold for now.
Workstation/Fusion patches shipped today will support SSBD when microcode patches are available.
This issue affects applications and/or execution runtimes which rely on managed code security mechanisms. Applications which consume untrusted data and rely on these mechanisms are at risk.
Operating System-Specific Mitigations are required as well, but we have not found any VMware appliances which would be affected by this issue. Regardless, we will be updating applicable open-source software in upcoming maintenance releases as a precautionary measure.

CVE-2018-3640

This issue led to a 4th speculative execution category which we have called Microcode Mitigations.
This issue is resolved by a microcode update and does not require any code changes for VMware products. Please contact your hardware vendor for information on mitigations for this vulnerability.

Based on current evaluations, we do not believe that CVE-2018-3639 or CVE-2018-3640 could allow for VM to VM or Hypervisor to VM Information disclosure. Thus, Hypervisor-Specific Mitigations are not required.

Documentation Summary:

Advisory: VMSA-2018-0012
Source of Truth KB: KB54951
Patching/Upgrade Guide: KB55111
Performance Info: KB55210

Customers should review the available documentation and direct questions to VMware Support.

NVIDIA GPU Display Driver Security Updates for Multiple Vulnerabilities

Greetings from the VMware Response Center!

Today we wanted to make you aware that NVIDIA has released a security bulletin entitled NVIDIA GPU Display Driver Security Updates for Multiple Vulnerabilities which details some NVIDIA GPU Display Driver Vulnerabilities and remediation.

CVE-2018-6251 and CVE-2018-6253 have been shown to affect VMware Workstation, but they are not something that we can fully resolve from our end. Therefore, we wanted to make sure you were informed of these issues so that they can be appropriately resolved. In addition, enterprise customers should check the NVIDIA Enterprise Dashboard for additional information.

Customers should review the available documentation and direct technical inquiries to VMware Support for further assistance.

New VMware Security Advisory VMSA-2018-0010

Today VMware has released the following new security advisory:

VMSA-2018-0010Horizon DaaS update addresses a broken authentication issue

This documents the remediation of a moderate severity issue (CVE-2018-6960) in VMware Horizon DaaS that may allow an attacker to bypass two-factor authentication. In order to exploit this issue, an attacker must have a legitimate account on Horizon DaaS.

All VMware Horizon DaaS 7.x versions are affected. This issue has been addressed in VMware Horizon DaaS 8.0.0.

We would like to thank Peter Ivezaj, President – Digital Upkeep for reporting this issue to us.

Please sign up to the Security-Announce mailing list to receive new and updated VMware Security Advisories.

Customers should review the security advisories and direct any questions to VMware Support.

New VMware Security Advisory VMSA-2018-0009

Today VMware has released the following new security advisory:

VMSA-2018-0009  – vRealize Automation (vRA) updates address multiple security issues

This documents the remediation of Important and Moderate severity issues (CVE-2018-6958  and CVE-2018-6959).

Issue (a)  CVE-2018-6958 is a DOM-based cross-site scripting (XSS) vulnerability. Exploitation of this issue may lead to the compromise of the vRA user’s workstation.

Issue (b) CVE-2018-6959 is a vulnerability in the handling of session IDs. Exploitation of this issue may lead to the hijacking of a valid vRA user’s session.

vRealize Automation 7.3.1 and 7.4.0 provide remediations for these vulnerabilities.

VMware would like to thank Oliver Matula and Benjamin Schwendemann of ERNW Enno Rey Netzwerke GmbH for reporting these issues to us.

Please sign up to the Security-Announce mailing list to receive new and updated VMware Security Advisories.

Customers should review the security advisories and direct any questions to VMware Support.