VMware on Friday informed customers that two potentially serious pixel shader vulnerabilities have been patched in its ESXi, Workstation and Fusion products, including one caused by a flaw in an NVIDIA graphics driver.
The more serious of the security holes, CVE-2019-5684, has been described as an out-of-bounds write bug that can allow arbitrary code execution on the host. This flaw affects systems using NVIDIA display drivers for Windows.
Piotr Bania of Cisco Talos has been credited by NVIDIA and VMware for reporting this vulnerability, which NVIDIA has classified as “high severity” with a CVSS score of 7.8. Updates released last week by NVIDIA for its GPU Display Driver patch this weakness.
“NVIDIA Windows GPU Display Driver contains a vulnerability in DirectX drivers, in which a specially crafted shader can cause an out of bounds access of an input texture array, which may lead to denial of service or code execution,” NVIDIA wrote in its advisory.
In addition, NVIDIA has addressed two other high-severity and two medium-severity vulnerabilities in its Windows GPU Display Driver.
VMware, which assigned a CVSS score of 8.5 to CVE-2019-5684 and a severity rating of “important,” told customers that they can prevent attacks by installing its own patches for ESXi, Workstation and Fusion, or by installing the updated graphics driver from NVIDIA.
Bania also informed VMware of CVE-2019-5521, an out-of-bounds read issue whose exploitation can lead to information disclosure or a denial-of-service (DoS) condition on the host.
VMware pointed out that exploitation of CVE-2019-5684 and CVE-2019-5521 requires access to the targeted virtual machine and 3D graphics needs to be enabled. 3D graphics is enabled by default in Workstation and Fusion, but not in ESXi.
As for workarounds, VMware says they are the same as for CVE-2018-6977, a DoS vulnerability reported last year by Bania. The workaround involves disabling the 3D acceleration feature.
UPDATE. Cisco Talos has published a blog post describing the vulnerabilities found by Bania.
Related: VMware Patches DoS, Information Disclosure Flaws in Graphics Components
Related: VMware Patches Code Execution Flaw in Virtual Graphics Card
Related: VMware Patches Vulnerabilities in Tools, Workstation
Related: Many VMware Products Affected by SACK Linux Vulnerabilities