CVE-2017-16001: Race Condition
Published Nov 6, 2017
·Updated
In HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.1, a local attacker or malware can silently subvert the plugin update process in order to escalate to root privileges.
Affected Software
1 affected component
HashiCorp Vagrant VMware Fusion=5.0.1
Event History
Nov 6, 2017
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-16001?
CVE-2017-16001 has a high severity rating due to its potential for local root privilege escalation.
2
How do I fix CVE-2017-16001?
To fix CVE-2017-16001, update the HashiCorp Vagrant VMware Fusion plugin to a version later than 5.0.1.
3
Who is affected by CVE-2017-16001?
CVE-2017-16001 affects users of the HashiCorp Vagrant VMware Fusion plugin version 5.0.1.
4
What can an attacker do with CVE-2017-16001?
An attacker exploiting CVE-2017-16001 can gain root privileges by subverting the plugin's update process.
5
Is there a workaround for CVE-2017-16001?
Currently, the best workaround for CVE-2017-16001 is to uninstall the vulnerable version of the plugin until an update is applied.