CVE-2020-3960 : VMware ESXi (6.7 before ESXi670-202006401-SG and 6.5 before ESXi650-202005401-SG

VMware ESXi (6.7 before ESXi670-202006401-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.5), and Fusion (11.x before 11.5.5) contain an out-of-bounds read vulnerability in NVMe functionality. A malicious actor with local non-administrative access to a virtual machine with a virtual NVMe controller present may be able to read privileged information contained in physical memory.

Published 2021-09-15 13:15:08

Updated 2021-09-28 01:20:18

Source VMware

View at NVD, CVE.org

Products affected by CVE-2020-3960

Vmware » Workstation
Versions from including (>=) 15.0.0 and before (<) 15.5.5
cpe:2.3:a:vmware:workstation:*:*:*:*:*:*:*:*
Matching versions
Vmware » Fusion
Versions from including (>=) 11.0.0 and before (<) 11.5.5
cpe:2.3:a:vmware:fusion:*:*:*:*:*:*:*:*
Matching versions
Vmware » Vsphere Esxi » Version: 6.5 Update 650-201810002
cpe:2.3:o:vmware:vsphere_esxi:6.5:650-201810002:*:*:*:*:*:*
Matching versions
Vmware » Vsphere Esxi » Version: 6.5 Update 650-201901001
cpe:2.3:o:vmware:vsphere_esxi:6.5:650-201901001:*:*:*:*:*:*
Matching versions
Vmware » Vsphere Esxi » Version: 6.5 Update 650-201903001
cpe:2.3:o:vmware:vsphere_esxi:6.5:650-201903001:*:*:*:*:*:*
Matching versions
Vmware » Vsphere Esxi » Version: 6.5 Update 650-201905001
cpe:2.3:o:vmware:vsphere_esxi:6.5:650-201905001:*:*:*:*:*:*
Matching versions
Vmware » Vsphere Esxi » Version: 6.5 Update 650-201811001
cpe:2.3:o:vmware:vsphere_esxi:6.5:650-201811001:*:*:*:*:*:*
Matching versions
Vmware » Vsphere Esxi » Version: 6.5
cpe:2.3:o:vmware:vsphere_esxi:6.5:-:*:*:*:*:*:*
Matching versions
Vmware » Vsphere Esxi » Version: 6.5 Update 650-201701001
cpe:2.3:o:vmware:vsphere_esxi:6.5:650-201701001:*:*:*:*:*:*
Matching versions
Vmware » Vsphere Esxi » Version: 6.5 Update 650-201703001
cpe:2.3:o:vmware:vsphere_esxi:6.5:650-201703001:*:*:*:*:*:*
Matching versions
Vmware » Vsphere Esxi » Version: 6.5 Update 650-201703002
cpe:2.3:o:vmware:vsphere_esxi:6.5:650-201703002:*:*:*:*:*:*
Matching versions
Vmware » Vsphere Esxi » Version: 6.5 Update 650-201704001
cpe:2.3:o:vmware:vsphere_esxi:6.5:650-201704001:*:*:*:*:*:*
Matching versions
Vmware » Vsphere Esxi » Version: 6.5 Update 650-201710001
cpe:2.3:o:vmware:vsphere_esxi:6.5:650-201710001:*:*:*:*:*:*
Matching versions
Vmware » Vsphere Esxi » Version: 6.5 Update 650-201712001
cpe:2.3:o:vmware:vsphere_esxi:6.5:650-201712001:*:*:*:*:*:*
Matching versions
Vmware » Vsphere Esxi » Version: 6.5 Update 650-201803001
cpe:2.3:o:vmware:vsphere_esxi:6.5:650-201803001:*:*:*:*:*:*
Matching versions
Vmware » Vsphere Esxi » Version: 6.5 Update 650-201806001
cpe:2.3:o:vmware:vsphere_esxi:6.5:650-201806001:*:*:*:*:*:*
Matching versions
Vmware » Vsphere Esxi » Version: 6.5 Update 650-201808001
cpe:2.3:o:vmware:vsphere_esxi:6.5:650-201808001:*:*:*:*:*:*
Matching versions
Vmware » Vsphere Esxi » Version: 6.5 Update 650-201810001
cpe:2.3:o:vmware:vsphere_esxi:6.5:650-201810001:*:*:*:*:*:*
Matching versions
Vmware » Vsphere Esxi » Version: 6.5 Update 650-201908001
cpe:2.3:o:vmware:vsphere_esxi:6.5:650-201908001:*:*:*:*:*:*
Matching versions
Vmware » Vsphere Esxi » Version: 6.5 Update 650-201910001
cpe:2.3:o:vmware:vsphere_esxi:6.5:650-201910001:*:*:*:*:*:*
Matching versions
Vmware » Vsphere Esxi » Version: 6.7
cpe:2.3:o:vmware:vsphere_esxi:6.7:-:*:*:*:*:*:*
Matching versions
Vmware » Vsphere Esxi » Version: 6.7 Update 670-201911001
cpe:2.3:o:vmware:vsphere_esxi:6.7:670-201911001:*:*:*:*:*:*
Matching versions
Vmware » Vsphere Esxi » Version: 6.7 Update 670-202004001
cpe:2.3:o:vmware:vsphere_esxi:6.7:670-202004001:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2020-3960

Top countries where our scanners detected CVE-2020-3960

Top open port discovered on systems with this issue 443

IPs affected by CVE-2020-3960 1,888

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2020-3960!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2020-3960

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 10 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-3960

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
3.6	LOW	AV:L/AC:L/Au:N/C:P/I:N/A:P	3.9	4.9	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: Partial
8.4	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H	2.0	5.8	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Changed Confidentiality: High Integrity: None Availability: High

CWE ids for CVE-2020-3960

CWE-125 Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2020-3960

https://www.vmware.com/security/advisories/VMSA-2020-0012.html

VMSA-2020-0012
Patch;Vendor Advisory