Vulnerabilities

VMware Patches Potentially Serious Pixel Shader Vulnerabilities

VMware on Friday informed customers that two potentially serious pixel shader vulnerabilities have been patched in its ESXi, Workstation and Fusion products, including one caused by a flaw in an NVIDIA graphics driver.

Eduard Kovacs

August 5, 2019

The more serious of the security holes, CVE-2019-5684, has been described as an out-of-bounds write bug that can allow arbitrary code execution on the host. This flaw affects systems using NVIDIA display drivers for Windows.

Piotr Bania of Cisco Talos has been credited by NVIDIA and VMware for reporting this vulnerability, which NVIDIA has classified as “high severity” with a CVSS score of 7.8. Updates released last week by NVIDIA for its GPU Display Driver patch this weakness.

“NVIDIA Windows GPU Display Driver contains a vulnerability in DirectX drivers, in which a specially crafted shader can cause an out of bounds access of an input texture array, which may lead to denial of service or code execution,” NVIDIA wrote in its advisory.

In addition, NVIDIA has addressed two other high-severity and two medium-severity vulnerabilities in its Windows GPU Display Driver.

VMware, which assigned a CVSS score of 8.5 to CVE-2019-5684 and a severity rating of “important,” told customers that they can prevent attacks by installing its own patches for ESXi, Workstation and Fusion, or by installing the updated graphics driver from NVIDIA.

Bania also informed VMware of CVE-2019-5521, an out-of-bounds read issue whose exploitation can lead to information disclosure or a denial-of-service (DoS) condition on the host.

VMware pointed out that exploitation of CVE-2019-5684 and CVE-2019-5521 requires access to the targeted virtual machine and 3D graphics needs to be enabled. 3D graphics is enabled by default in Workstation and Fusion, but not in ESXi.

As for workarounds, VMware says they are the same as for CVE-2018-6977, a DoS vulnerability reported last year by Bania. The workaround involves disabling the 3D acceleration feature.

UPDATE. Cisco Talos has published a blog post describing the vulnerabilities found by Bania.

Written By Eduard Kovacs

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Latest News

Click to comment

How the Atomized Network Changed Enterprise Protection

Our networks have become atomized which, for starters, means they’re highly dispersed. Not just in terms of the infrastructure – legacy, on-premises, hybrid, multi-cloud, and edge.

Matt Wilson

Mapping Threat Intelligence to the NIST Compliance Framework Part 2

How threat intelligence is critical when justifying budget for GRC personnel, and for threat intelligence, incident response, security operations and CISO buyers.

Landon Winkelvoss

Password Dependency: How to Break the Cycle

Hackers rarely hack in anymore. They log in using stolen, weak, default, or otherwise compromised credentials. That’s why it’s so critical to break the password dependency cycle. But how can this be done?

Torsten George

Why CISOs Make Great Board Members

Cybersecurity-related risk is a top concern, so boards need to know they have the proper oversight in place. Even as first-timers, successful CISOs make for successful board members.

Galina Antova

A Change in Mindset: From a Threat-based to Risk-based Approach to Security

A threat-based approach to security often focuses on a checklist to meet industry requirements but overlooked the key component of security: reducing risk.

Marie Hattar