Out-of-Bounds Write Vulnerability in VMware ESXi, Workstation, and Fusion Products

CVE-2020-3968

What is CVE-2020-3968?

VMware products including ESXi, Workstation, and Fusion are affected by an out-of-bounds write vulnerability within the USB 3.0 controller (xHCI). This flaw can be exploited by a local attacker possessing administrative rights on a virtual machine, potentially resulting in a crash of the vmx process of the virtual machine. Such an attack could facilitate a denial of service condition or even allow execution of arbitrary code on the hypervisor. Certain conditions outside the attacker's control must also be satisfied for exploitation to occur.

References