VMware ESXi, Workstation, Fusion
At a glance
- Source
- NVD
- EPSS
- EPSS 1.11 % · percentile 66 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- vmware
- NVD status
- Modified
Description
In VMware ESXi (6.7 before ESXi670-201908101-SG, 6.5 before ESXi650-202007101-SG), Workstation (15.x before 15.1.0), Fusion (11.x before 11.1.0), the VMCI host drivers used by VMware hypervisors contain a memory leak vulnerability. A malicious actor with access to a virtual machine may be able to trigger a memory leak issue resulting in memory resource exhaustion on the hypervisor if the attack is sustained for extended periods of time.
Weaknesses (CWE)
- CWE-401 — Missing Release of Memory after Effective Lifetime
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | LOW 3.5 | AV:N/AC:M/Au:S/C:N/I:N/A:P | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2020-25260
- GCVE · GCVE-0-2020-3995
CERT-FR advisories
- CERTFR-2020-AVI-658 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:vmware:esxi:6.7:-:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201806001:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201807001:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201808001:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810001:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810101:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810102:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810103:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810201:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810202:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810203:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810204:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810205:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810206:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810207:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810208:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810209:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810210:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810211:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810212:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810213:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810214:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810215:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810216:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810217:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810218:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810219:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810220:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810221:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810222:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810223:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810224:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810225:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810226:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810227:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810228:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810229:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810230:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810231:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.7:670-201810232:*:*:*:*:*:*- +134 more
Affected products
| Product | Versions |
|---|---|
| VMware ESXi, Workstation, Fusion | affected VMware ESXi (6.7 before ESXi670-201908101-SG, 6.5 before ESXi650-202007101-SG), Workstation (15.x before 15.1.0), Fusion (11.x before 11.1.0) |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |