CVE-2023-20869

Published Apr 25, 2023

Last updated a year ago

VMware Workstation

Overview

AI description

Automated description summarized from trusted sources.

CVE-2023-20869 is a stack-based buffer overflow vulnerability found in VMware Workstation (17.x) and VMware Fusion (13.x). It exists in the functionality that shares host Bluetooth devices with the virtual machine. The vulnerability was reported by STAR Labs during the Pwn2Own 2023 Security Contest and publicly disclosed on April 25, 2023. An attacker with local administrative privileges on a virtual machine could exploit this vulnerability to execute code as the virtual machine's VMX process running on the host. This could lead to complete compromise of the hypervisor. The vulnerability exists within the UHCI component and stems from inadequate validation of user-supplied data length before copying it to a fixed-length stack-based buffer.

Description: VMware Workstation (17.x) and VMware Fusion (13.x) contain a stack-based buffer-overflow vulnerability that exists in the functionality for sharing host Bluetooth devices with the virtual machine.
Source: security@vmware.com
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 8.2
Impact score: 6
Exploitability score: 1.5
Vector string: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Severity: HIGH

Weaknesses

nvd@nist.gov: CWE-787
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-787

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:vmware:fusion:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "B628132D-043A-4989-9524-9FA53B1DEADC",
            "versionEndExcluding": "13.0.2",
            "versionStartIncluding": "13.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:vmware:workstation:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "53930936-892B-421E-B75C-BD2DEC4A09AA",
            "versionEndExcluding": "17.0.2",
            "versionStartIncluding": "17.0.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.