CVE-2020-4005

7.8HIGH

Key Information:

Vendor
Vmware
Status
Vmware Esxi
Vendor
CVE Published:
20 November 2020

Summary

VMware ESXi (7.0 before ESXi70U1b-17168206, 6.7 before ESXi670-202011101-SG, 6.5 before ESXi650-202011301-SG) contains a privilege-escalation vulnerability that exists in the way certain system calls are being managed. A malicious actor with privileges within the VMX process only, may escalate their privileges on the affected system. Successful exploitation of this issue is only possible when chained with another vulnerability (e.g. CVE-2020-4004)

Affected Version(s)

VMware ESXi 7.0 before ESXi70U1b-17168206

VMware ESXi 6.7 before ESXi670-202011101-SG

VMware ESXi 6.5 before ESXi650-202011301-SG

References

https://www.vmware.com/security/advisories/VMSA-2020-0026...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.