A few days ago, 2017-03-28, VMware released a few security patches that will prevent a guest from execute code on the ESXi host. This has been possible based on heap buffer overflow and uninitialized stack memory usage in SVGA. Available VMware KB articles for these issues are:
Affected VMware ESXi versions are:
- 6.5 – Read the related KB here
- 6.0 – Read the related KB here
- 6.0 patch on top of ESXi 6.0 U2 – Read the related KB here
- 6.0 patch on top of ESXi 6.0 U1 – Read the related KB here
- 5.5 – Read the related KB here
In addition to ESXi, VMware Fusion, VMware Player and VMware Workstation are also affected and the below patches will fix the problem:
Read the complete VMware Security Advisories VMSA-2017-0006 for more information.
2 pings