Security updates released on Thursday by VMware for its vCloud Director, ESXi, Workstation and Fusion products patch several vulnerabilities, including ones disclosed recently at the Pwn2Own 2019 hacking competition.
At Pwn2Own 2019, Amat Cama and Richard Zhu of team Fluoroacetate demonstrated two VMware Workstation vulnerabilities, including one that was leveraged in a complex exploit targeting Microsoft’s Edge browser. They earned $70,000 for escaping a VMware Workstation virtual machine and executing code on the underlying host operating system, and $130,000 for the Edge exploit.
Updates released by VMware this week for ESXi, Workstation, and Fusion (only on macOS) address these flaws. The vendor has described the issues as an out-of-bounds read/write vulnerability and a Time-of-Check-Time-of-Use (TOCTOU) bug in the virtual USB 1.1 Universal Host Controller Interface (UHCI). The CVE identifiers CVE-2019-5518 and CVE-2019-5519 have been assigned to these vulnerabilities, with both classified as “critical.”
VMware has also patched a critical out-of-bounds write vulnerability in the e1000 virtual network adapter used by Workstation and Fusion (only on macOS). The security hole, discovered by Zhangyanyu of Chinese company Chaitin Tech, can allow a guest to execute arbitrary code on the host. This issue is tracked as CVE-2019-5524.
A similar flaw affecting Workstation and Fusion was identified by ZhanluLab in the e1000 and e1000e virtual network adapters. While exploiting this weakness can lead to code execution on the host from the guest operating system, the more likely outcome is a denial-of-service (DoS) condition on the guest. A severity rating of “important” has been assigned to this issue.