Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

VMware Patches Potentially Serious Pixel Shader Vulnerabilities

VMware on Friday informed customers that two potentially serious pixel shader vulnerabilities have been patched in its ESXi, Workstation and Fusion products, including one caused by a flaw in an NVIDIA graphics driver.

VMware on Friday informed customers that two potentially serious pixel shader vulnerabilities have been patched in its ESXi, Workstation and Fusion products, including one caused by a flaw in an NVIDIA graphics driver.

The more serious of the security holes, CVE-2019-5684, has been described as an out-of-bounds write bug that can allow arbitrary code execution on the host. This flaw affects systems using NVIDIA display drivers for Windows.

Piotr Bania of Cisco Talos has been credited by NVIDIA and VMware for reporting this vulnerability, which NVIDIA has classified as “high severity” with a CVSS score of 7.8. Updates released last week by NVIDIA for its GPU Display Driver patch this weakness.

“NVIDIA Windows GPU Display Driver contains a vulnerability in DirectX drivers, in which a specially crafted shader can cause an out of bounds access of an input texture array, which may lead to denial of service or code execution,” NVIDIA wrote in its advisory.

In addition, NVIDIA has addressed two other high-severity and two medium-severity vulnerabilities in its Windows GPU Display Driver.

VMware, which assigned a CVSS score of 8.5 to CVE-2019-5684 and a severity rating of “important,” told customers that they can prevent attacks by installing its own patches for ESXi, Workstation and Fusion, or by installing the updated graphics driver from NVIDIA.

Bania also informed VMware of CVE-2019-5521, an out-of-bounds read issue whose exploitation can lead to information disclosure or a denial-of-service (DoS) condition on the host.

VMware pointed out that exploitation of CVE-2019-5684 and CVE-2019-5521 requires access to the targeted virtual machine and 3D graphics needs to be enabled. 3D graphics is enabled by default in Workstation and Fusion, but not in ESXi.

Advertisement. Scroll to continue reading.

As for workarounds, VMware says they are the same as for CVE-2018-6977, a DoS vulnerability reported last year by Bania. The workaround involves disabling the 3D acceleration feature.

UPDATE. Cisco Talos has published a blog post describing the vulnerabilities found by Bania.

Related: VMware Patches DoS, Information Disclosure Flaws in Graphics Components

Related: VMware Patches Code Execution Flaw in Virtual Graphics Card

Related: VMware Patches Vulnerabilities in Tools, Workstation

Related: Many VMware Products Affected by SACK Linux Vulnerabilities

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

The AI Risk Summit brings together security and risk management executives, AI researchers, policy makers, software developers and influential business and government stakeholders.

Register

People on the Move

Retired U.S. Army General and former NSA Director Paul M. Nakasone has joined the Board of Directors at OpenAI.

Jill Passalacqua has been appointed Chief Legal Officer at autonomous security solutions provider Horizon3.ai.

Cisco has appointed Sean Duca as CISO and Practice Leader for the APJC region.

More People On The Move

Expert Insights