Vulnerability Name:

CVE-2017-4903 (CCN-123961)

Assigned:2016-12-26
Published:2017-03-28
Updated:2022-02-03
Summary:VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi600-201703403-SG, 6.0 U1 without patch ESXi600-201703402-SG, and 5.5 without patch ESXi550-201703401-SG; Workstation Pro / Player 12.x prior to 12.5.5; and Fusion Pro / Fusion 8.x prior to 8.5.6 have an uninitialized stack memory usage in SVGA. This issue may allow a guest to execute code on the host.
CVSS v3 Severity:8.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
7.7 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
8.4 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
7.3 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:7.2 High (CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
7.2 High (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-119
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2017-4903

Source: CCN
Type: IBM Security Bulletin 2009145 (PureApplication System)
Open Source VMware Fusion Vulnerabilities in IBM Pure Application System (CVE-2017-4903, CVE-2017-4904, CVE-2017-4905)

Source: BID
Type: Third Party Advisory, VDB Entry
97160

Source: CCN
Type: BID-97160
Multiple VMware Products CVE-2017-4903 Local Memory Corruption Vulnerability

Source: SECTRACK
Type: Third Party Advisory, VDB Entry
1038148

Source: SECTRACK
Type: Third Party Advisory, VDB Entry
1038149

Source: CCN
Type: VMware Security Advisory VMSA-2017-0006
VMware ESXi, Workstation and Fusion updates address critical and moderate security issues

Source: CONFIRM
Type: Patch, Vendor Advisory
http://www.vmware.com/security/advisories/VMSA-2017-0006.html

Source: XF
Type: UNKNOWN
vmware-cve20174903-code-exec(123961)

Source: CCN
Type: ZDI-17-237
(Pwn2Own) VMware Workstation SVGA Uninitialized Memory Privilege Escalation Vulnerability

Vulnerable Configuration:Configuration 1:
  • cpe:/a:vmware:workstation_player:*:*:*:*:*:*:*:* (Version >= 12.0.0 and < 12.5.5)
  • OR cpe:/a:vmware:workstation_pro:*:*:*:*:*:*:*:* (Version >= 12.0.0 and < 12.5.5)
  • OR cpe:/o:vmware:esxi:5.5:-:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:5.5:1:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:5.5:2:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:5.5:3a:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:5.5:3b:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:-:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:1:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:1a:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:1b:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:2:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:3:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:3a:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201504401:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201505401:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201507101:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201507102:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201507401:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201507402:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201507403:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201507404:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201507405:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201507406:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201507407:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201509101:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201509102:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201509201:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201509202:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201509203:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201509204:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201509205:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201509206:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201509207:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201509208:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201509209:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201509210:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201510401:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201511401:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201601101:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201601102:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201601401:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201601402:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201601403:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201601404:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201601405:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201602401:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201603101:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201603102:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201603201:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201603202:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201603203:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201603204:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201603205:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201603206:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201603207:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201603208:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201605401:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201608101:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201608401:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201608402:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201608403:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201608404:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201608405:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201610410:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201611401:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201611402:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201611403:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201702101:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201702102:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201702201:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201702202:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201702203:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201702204:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201702205:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201702206:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201702207:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201702208:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201702209:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201702210:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201702211:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:600-201702212:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.5:-:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.5:650-201701001:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.5:650-201703001:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.5:650-201703002:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/a:vmware:fusion:*:*:*:*:*:*:*:* (Version >= 8.0.0 and < 8.5.6)
  • OR cpe:/a:vmware:fusion_pro:*:*:*:*:*:*:*:* (Version >= 8.0.0 and < 8.5.6)
  • AND
  • cpe:/o:apple:mac_os_x:-:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/o:vmware:esxi:5.5:*:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.0:*:*:*:*:*:*:*
  • OR cpe:/o:vmware:esxi:6.5:*:*:*:*:*:*:*
  • AND
  • cpe:/a:ibm:pureapplication_system:2.1.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:pureapplication_system:2.1.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:pureapplication_system:2.1.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:pureapplication_system:2.1.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:pureapplication_system:2.1.2.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:pureapplication_system:2.1.2.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:pureapplication_system:2.2.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:pureapplication_system:2.2.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:pureapplication_system:2.1.2.3:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:pureapplication_system:2.2.2.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:pureapplication_system:2.2.2.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:pureapplication_system:2.1.2.4:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:pureapplication_system:2.2.2.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:pureapplication_system:2.2.3.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:pureapplication_system:2.2.3.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:pureapplication_system:2.2.3.2:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    vmware workstation player *
    vmware workstation pro *
    vmware esxi 5.5 -
    vmware esxi 5.5 1
    vmware esxi 5.5 2
    vmware esxi 5.5 3a
    vmware esxi 5.5 3b
    vmware esxi 6.0 -
    vmware esxi 6.0 1
    vmware esxi 6.0 1a
    vmware esxi 6.0 1b
    vmware esxi 6.0 2
    vmware esxi 6.0 3
    vmware esxi 6.0 3a
    vmware esxi 6.0 600-201504401
    vmware esxi 6.0 600-201505401
    vmware esxi 6.0 600-201507101
    vmware esxi 6.0 600-201507102
    vmware esxi 6.0 600-201507401
    vmware esxi 6.0 600-201507402
    vmware esxi 6.0 600-201507403
    vmware esxi 6.0 600-201507404
    vmware esxi 6.0 600-201507405
    vmware esxi 6.0 600-201507406
    vmware esxi 6.0 600-201507407
    vmware esxi 6.0 600-201509101
    vmware esxi 6.0 600-201509102
    vmware esxi 6.0 600-201509201
    vmware esxi 6.0 600-201509202
    vmware esxi 6.0 600-201509203
    vmware esxi 6.0 600-201509204
    vmware esxi 6.0 600-201509205
    vmware esxi 6.0 600-201509206
    vmware esxi 6.0 600-201509207
    vmware esxi 6.0 600-201509208
    vmware esxi 6.0 600-201509209
    vmware esxi 6.0 600-201509210
    vmware esxi 6.0 600-201510401
    vmware esxi 6.0 600-201511401
    vmware esxi 6.0 600-201601101
    vmware esxi 6.0 600-201601102
    vmware esxi 6.0 600-201601401
    vmware esxi 6.0 600-201601402
    vmware esxi 6.0 600-201601403
    vmware esxi 6.0 600-201601404
    vmware esxi 6.0 600-201601405
    vmware esxi 6.0 600-201602401
    vmware esxi 6.0 600-201603101
    vmware esxi 6.0 600-201603102
    vmware esxi 6.0 600-201603201
    vmware esxi 6.0 600-201603202
    vmware esxi 6.0 600-201603203
    vmware esxi 6.0 600-201603204
    vmware esxi 6.0 600-201603205
    vmware esxi 6.0 600-201603206
    vmware esxi 6.0 600-201603207
    vmware esxi 6.0 600-201603208
    vmware esxi 6.0 600-201605401
    vmware esxi 6.0 600-201608101
    vmware esxi 6.0 600-201608401
    vmware esxi 6.0 600-201608402
    vmware esxi 6.0 600-201608403
    vmware esxi 6.0 600-201608404
    vmware esxi 6.0 600-201608405
    vmware esxi 6.0 600-201610410
    vmware esxi 6.0 600-201611401
    vmware esxi 6.0 600-201611402
    vmware esxi 6.0 600-201611403
    vmware esxi 6.0 600-201702101
    vmware esxi 6.0 600-201702102
    vmware esxi 6.0 600-201702201
    vmware esxi 6.0 600-201702202
    vmware esxi 6.0 600-201702203
    vmware esxi 6.0 600-201702204
    vmware esxi 6.0 600-201702205
    vmware esxi 6.0 600-201702206
    vmware esxi 6.0 600-201702207
    vmware esxi 6.0 600-201702208
    vmware esxi 6.0 600-201702209
    vmware esxi 6.0 600-201702210
    vmware esxi 6.0 600-201702211
    vmware esxi 6.0 600-201702212
    vmware esxi 6.5 -
    vmware esxi 6.5 650-201701001
    vmware esxi 6.5 650-201703001
    vmware esxi 6.5 650-201703002
    vmware fusion *
    vmware fusion pro *
    apple mac os x -
    vmware esxi 5.5
    vmware esxi 6.0
    vmware esxi 6.5
    ibm pureapplication system 2.1.0.0
    ibm pureapplication system 2.1.0.1
    ibm pureapplication system 2.1.0.2
    ibm pureapplication system 2.1.1.0
    ibm pureapplication system 2.1.2.0
    ibm pureapplication system 2.1.2.1
    ibm pureapplication system 2.2.0.0
    ibm pureapplication system 2.2.1.0
    ibm pureapplication system 2.1.2.3
    ibm pureapplication system 2.2.2.0
    ibm pureapplication system 2.2.2.1
    ibm pureapplication system 2.1.2.4
    ibm pureapplication system 2.2.2.2
    ibm pureapplication system 2.2.3.0
    ibm pureapplication system 2.2.3.1
    ibm pureapplication system 2.2.3.2