Security updates released on Thursday by VMware for its vCloud Director, ESXi, Workstation and Fusion products patch several vulnerabilities, including ones disclosed recently at the Pwn2Own 2019 hacking competition.
At Pwn2Own 2019, Amat Cama and Richard Zhu of team Fluoroacetate demonstrated two VMware Workstation vulnerabilities, including one that was leveraged in a complex exploit targeting Microsoft’s Edge browser. They earned $70,000 for escaping a VMware Workstation virtual machine and executing code on the underlying host operating system, and $130,000 for the Edge exploit.
Updates released by VMware this week for ESXi, Workstation, and Fusion (only on macOS) address these flaws. The vendor has described the issues as an out-of-bounds read/write vulnerability and a Time-of-Check-Time-of-Use (TOCTOU) bug in the virtual USB 1.1 Universal Host Controller Interface (UHCI). The CVE identifiers CVE-2019-5518 and CVE-2019-5519 have been assigned to these vulnerabilities, with both classified as “critical.”
VMware has also patched a critical out-of-bounds write vulnerability in the e1000 virtual network adapter used by Workstation and Fusion (only on macOS). The security hole, discovered by Zhangyanyu of Chinese company Chaitin Tech, can allow a guest to execute arbitrary code on the host. This issue is tracked as CVE-2019-5524.
A similar flaw affecting Workstation and Fusion was identified by ZhanluLab in the e1000 and e1000e virtual network adapters. While exploiting this weakness can lead to code execution on the host from the guest operating system, the more likely outcome is a denial-of-service (DoS) condition on the guest. A severity rating of “important” has been assigned to this issue.
VMware informed customers that Fusion 11.x running on macOS is affected by a critical vulnerability tracked as CVE-2019-5514. The flaw was reported independently to the company by a Chinese researcher who uses the online moniker CodeColorist and Hungary-based researcher Csaba Fitzl.
“VMware Fusion contains a security vulnerability due to certain unauthenticated APIs accessible through a web socket. An attacker may exploit this issue by tricking the host user to execute a JavaScript to perform unauthorized functions on the guest machine where VMware Tools is installed. This may further be exploited to execute commands on the guest machines,” VMware explained in its advisory.
In a separate advisory published on Thursday, VMware described a critical vulnerability affecting VMware vCloud Director for Service Providers. The flaw, tracked as CVE-2019-5523, impacts vCD 9.5.x on any platform and it allows a remote attacker to hijack sessions for the Tenant and Provider portals by impersonating a currently logged-in session.
Related: VMware Patches Code Execution Flaw in Virtual Graphics Card
Related: VMware Patches VM Escape Flaw Disclosed at Chinese Hacking Contest