VMware Patches VM Escape Flaw Disclosed at Chinese Hacking Contest

guest · Nov 9, 2018

VMware Patches VM Escape Flaw Disclosed at Chinese Hacking Contest
November 9, 2018
https://www.securityweek.com/vmware-patches-vm-escape-flaw-disclosed-chinese-hacking-contest

Organized by the security team of Chinese company Keen Cloud Tech, GeekPwn is a hacking competition that in the past years has led to the discovery of many important vulnerabilities.

Shortly after the VM escape exploit was demonstrated, Chaitin Tech wrote on Twitter that it was the first time anybody managed to escape VMware ESXi and get a root shell on the host system. The company posted a short video showing the exploit in action.

According to the virtualization giant, the vulnerabilities, tracked as CVE-2018-6981 and CVE-2018-6982, are caused by an uninitialized stack memory usage bug in the vmxnet3 virtual network adapter.

CVE-2018-6981 affects ESXi, Fusion and Workstation products, and it can allow a guest to execute arbitrary code on the host, while CVE-2018-6982, which only impacts ESXi, can result in an information leak from the host to the guest. VMware pointed out that the vulnerabilities are only present if the vmxnet3 adapter is enabled – other adapters are not impacted.
Click to expand...

VMware has released patches and updates for both vulnerabilities.
Click to expand...

Log in or Sign up

VMware Patches VM Escape Flaw Disclosed at Chinese Hacking Contest

guest Guest

Log in or Sign up

VMware Patches VM Escape Flaw Disclosed at Chinese Hacking Contest

guest Guest

Useful Searches