Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

VMware Patches Potentially Serious Pixel Shader Vulnerabilities

VMware on Friday informed customers that two potentially serious pixel shader vulnerabilities have been patched in its ESXi, Workstation and Fusion products, including one caused by a flaw in an NVIDIA graphics driver.

VMware on Friday informed customers that two potentially serious pixel shader vulnerabilities have been patched in its ESXi, Workstation and Fusion products, including one caused by a flaw in an NVIDIA graphics driver.

The more serious of the security holes, CVE-2019-5684, has been described as an out-of-bounds write bug that can allow arbitrary code execution on the host. This flaw affects systems using NVIDIA display drivers for Windows.

Piotr Bania of Cisco Talos has been credited by NVIDIA and VMware for reporting this vulnerability, which NVIDIA has classified as “high severity” with a CVSS score of 7.8. Updates released last week by NVIDIA for its GPU Display Driver patch this weakness.

“NVIDIA Windows GPU Display Driver contains a vulnerability in DirectX drivers, in which a specially crafted shader can cause an out of bounds access of an input texture array, which may lead to denial of service or code execution,” NVIDIA wrote in its advisory.

In addition, NVIDIA has addressed two other high-severity and two medium-severity vulnerabilities in its Windows GPU Display Driver.

VMware, which assigned a CVSS score of 8.5 to CVE-2019-5684 and a severity rating of “important,” told customers that they can prevent attacks by installing its own patches for ESXi, Workstation and Fusion, or by installing the updated graphics driver from NVIDIA.

Bania also informed VMware of CVE-2019-5521, an out-of-bounds read issue whose exploitation can lead to information disclosure or a denial-of-service (DoS) condition on the host.

VMware pointed out that exploitation of CVE-2019-5684 and CVE-2019-5521 requires access to the targeted virtual machine and 3D graphics needs to be enabled. 3D graphics is enabled by default in Workstation and Fusion, but not in ESXi.

Advertisement. Scroll to continue reading.

As for workarounds, VMware says they are the same as for CVE-2018-6977, a DoS vulnerability reported last year by Bania. The workaround involves disabling the 3D acceleration feature.

UPDATE. Cisco Talos has published a blog post describing the vulnerabilities found by Bania.

Related: VMware Patches DoS, Information Disclosure Flaws in Graphics Components

Related: VMware Patches Code Execution Flaw in Virtual Graphics Card

Related: VMware Patches Vulnerabilities in Tools, Workstation

Related: Many VMware Products Affected by SACK Linux Vulnerabilities

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

Expert Insights

Related Content

Vulnerabilities

Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...

Vulnerabilities

A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...

Cybercrime

Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.

Vulnerabilities

Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.

Vulnerabilities

The latest Chrome update brings patches for eight vulnerabilities, including seven reported by external researchers.