CVE-2017-4938: Null Pointer Dereference

Published Nov 17, 2017

Updated

VMware Workstation (12.x before 12.5.8) and Fusion (8.x before 8.5.9) contain a guest RPC NULL pointer dereference vulnerability. Successful exploitation of this issue may allow attackers with normal user privileges to crash their VMs.

Affected Software

26 affected components

VMware Workstation=12.0.0

VMware Workstation=12.0.1

VMware Workstation=12.1

VMware Workstation=12.1.1

VMware Workstation=12.5

VMware Workstation=12.5.1

VMware Workstation=12.5.2

VMware Workstation=12.5.3

VMware Workstation=12.5.4

VMware Workstation=12.5.5

VMware Workstation=12.5.6

VMware Workstation=12.5.7

VMware Fusion=8.0.0

VMware Fusion=8.0.1

VMware Fusion=8.0.2

VMware Fusion=8.1.0

VMware Fusion=8.1.1

VMware Fusion=8.5.0

VMware Fusion=8.5.1

VMware Fusion=8.5.2

VMware Fusion=8.5.3

VMware Fusion=8.5.4

VMware Fusion=8.5.5

VMware Fusion=8.5.6

VMware Fusion=8.5.7

VMware Fusion=8.5.8

Remediation

Patch Available

https://www.vmware.com/security/advisories/VMSA-2017-0018.html

Event History

Nov 17, 2017

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2017-4938?

CVE-2017-4938 has a moderate severity level as it allows for potential denial of service through guest RPC NULL pointer dereference.

How do I fix CVE-2017-4938?

To fix CVE-2017-4938, users should update VMware Workstation to version 12.5.8 or later and VMware Fusion to version 8.5.9 or later.

Who is affected by CVE-2017-4938?

CVE-2017-4938 affects users of VMware Workstation versions 12.x before 12.5.8 and VMware Fusion versions 8.x before 8.5.9.

What type of vulnerability is CVE-2017-4938?

CVE-2017-4938 is classified as a NULL pointer dereference vulnerability within the guest RPC service.

What can happen if CVE-2017-4938 is exploited?

Exploitation of CVE-2017-4938 may allow an attacker to crash their virtual machines.