CVE-2020-3969: VMware Workstation SVGA3D Command Heap Overflow Privilege Escalation Vulnerability
First published: Wed Jun 24 2020(Updated: )
This vulnerability allows local attackers to escalate privileges on affected installations of VMware Workstation. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the implementation of SVGA3D commands. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the hypervisor.
Credit: security@vmware.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| VMware Workstation | ||
| VMware vCenter Server and Cloud Foundation | >=3.0<3.10 | |
| VMware vCenter Server and Cloud Foundation | >=4.0.0<4.0.1 | |
| VMware Fusion Pro | >=11.0.0<11.5.5 | |
| VMware Workstation | >=15.0.0<15.5.5 | |
| VMware ESXi | =6.5 | |
| VMware ESXi | =6.5-650-201701001 | |
| VMware ESXi | =6.5-650-201703001 | |
| VMware ESXi | =6.5-650-201703002 | |
| VMware ESXi | =6.5-650-201704001 | |
| VMware ESXi | =6.5-650-201707101 | |
| VMware ESXi | =6.5-650-201707102 | |
| VMware ESXi | =6.5-650-201707103 | |
| VMware ESXi | =6.5-650-201707201 | |
| VMware ESXi | =6.5-650-201707202 | |
| VMware ESXi | =6.5-650-201707203 | |
| VMware ESXi | =6.5-650-201707204 | |
| VMware ESXi | =6.5-650-201707205 | |
| VMware ESXi | =6.5-650-201707206 | |
| VMware ESXi | =6.5-650-201707207 | |
| VMware ESXi | =6.5-650-201707208 | |
| VMware ESXi | =6.5-650-201707209 | |
| VMware ESXi | =6.5-650-201707210 | |
| VMware ESXi | =6.5-650-201707211 | |
| VMware ESXi | =6.5-650-201707212 | |
| VMware ESXi | =6.5-650-201707213 | |
| VMware ESXi | =6.5-650-201707214 | |
| VMware ESXi | =6.5-650-201707215 | |
| VMware ESXi | =6.5-650-201707216 | |
| VMware ESXi | =6.5-650-201707217 | |
| VMware ESXi | =6.5-650-201707218 | |
| VMware ESXi | =6.5-650-201707219 | |
| VMware ESXi | =6.5-650-201707220 | |
| VMware ESXi | =6.5-650-201707221 | |
| VMware ESXi | =6.5-650-201710001 | |
| VMware ESXi | =6.5-650-201712001 | |
| VMware ESXi | =6.5-650-201803001 | |
| VMware ESXi | =6.5-650-201806001 | |
| VMware ESXi | =6.5-650-201808001 | |
| VMware ESXi | =6.5-650-201810001 | |
| VMware ESXi | =6.5-650-201810002 | |
| VMware ESXi | =6.5-650-201811001 | |
| VMware ESXi | =6.5-650-201811002 | |
| VMware ESXi | =6.5-650-201811301 | |
| VMware ESXi | =6.5-650-201901001 | |
| VMware ESXi | =6.5-650-201903001 | |
| VMware ESXi | =6.5-650-201905001 | |
| VMware ESXi | =6.5-650-201908001 | |
| VMware ESXi | =6.5-650-201910001 | |
| VMware ESXi | =6.5-650-20191004001 | |
| VMware ESXi | =6.5-650-201911001 | |
| VMware ESXi | =6.5-650-201911401 | |
| VMware ESXi | =6.5-650-201911402 | |
| VMware ESXi | =6.5-650-201912001 | |
| VMware ESXi | =6.5-650-201912002 | |
| VMware ESXi | =6.5-650-201912101 | |
| VMware ESXi | =6.5-650-201912102 | |
| VMware ESXi | =6.5-650-201912103 | |
| VMware ESXi | =6.5-650-201912104 | |
| VMware ESXi | =6.5-650-201912301 | |
| VMware ESXi | =6.5-650-201912401 | |
| VMware ESXi | =6.5-650-201912402 | |
| VMware ESXi | =6.5-650-201912403 | |
| VMware ESXi | =6.5-650-201912404 | |
| VMware ESXi | =6.5-650-202005001 | |
| VMware ESXi | =6.7 | |
| VMware ESXi | =6.7-670-201806001 | |
| VMware ESXi | =6.7-670-201807001 | |
| VMware ESXi | =6.7-670-201808001 | |
| VMware ESXi | =6.7-670-201810001 | |
| VMware ESXi | =6.7-670-201810101 | |
| VMware ESXi | =6.7-670-201810102 | |
| VMware ESXi | =6.7-670-201810103 | |
| VMware ESXi | =6.7-670-201810201 | |
| VMware ESXi | =6.7-670-201810202 | |
| VMware ESXi | =6.7-670-201810203 | |
| VMware ESXi | =6.7-670-201810204 | |
| VMware ESXi | =6.7-670-201810205 | |
| VMware ESXi | =6.7-670-201810206 | |
| VMware ESXi | =6.7-670-201810207 | |
| VMware ESXi | =6.7-670-201810208 | |
| VMware ESXi | =6.7-670-201810209 | |
| VMware ESXi | =6.7-670-201810210 | |
| VMware ESXi | =6.7-670-201810211 | |
| VMware ESXi | =6.7-670-201810212 | |
| VMware ESXi | =6.7-670-201810213 | |
| VMware ESXi | =6.7-670-201810214 | |
| VMware ESXi | =6.7-670-201810215 | |
| VMware ESXi | =6.7-670-201810216 | |
| VMware ESXi | =6.7-670-201810217 | |
| VMware ESXi | =6.7-670-201810218 | |
| VMware ESXi | =6.7-670-201810219 | |
| VMware ESXi | =6.7-670-201810220 | |
| VMware ESXi | =6.7-670-201810221 | |
| VMware ESXi | =6.7-670-201810222 | |
| VMware ESXi | =6.7-670-201810223 | |
| VMware ESXi | =6.7-670-201810224 | |
| VMware ESXi | =6.7-670-201810225 | |
| VMware ESXi | =6.7-670-201810226 | |
| VMware ESXi | =6.7-670-201810227 | |
| VMware ESXi | =6.7-670-201810228 | |
| VMware ESXi | =6.7-670-201810229 | |
| VMware ESXi | =6.7-670-201810230 | |
| VMware ESXi | =6.7-670-201810231 | |
| VMware ESXi | =6.7-670-201810232 | |
| VMware ESXi | =6.7-670-201810233 | |
| VMware ESXi | =6.7-670-201810234 | |
| VMware ESXi | =6.7-670-201811001 | |
| VMware ESXi | =6.7-670-201901001 | |
| VMware ESXi | =6.7-670-201901401 | |
| VMware ESXi | =6.7-670-201901402 | |
| VMware ESXi | =6.7-670-201901403 | |
| VMware ESXi | =6.7-670-201903001 | |
| VMware ESXi | =6.7-670-201904001 | |
| VMware ESXi | =6.7-670-201904201 | |
| VMware ESXi | =6.7-670-201904202 | |
| VMware ESXi | =6.7-670-201904203 | |
| VMware ESXi | =6.7-670-201904204 | |
| VMware ESXi | =6.7-670-201904205 | |
| VMware ESXi | =6.7-670-201904206 | |
| VMware ESXi | =6.7-670-201904207 | |
| VMware ESXi | =6.7-670-201904208 | |
| VMware ESXi | =6.7-670-201904209 | |
| VMware ESXi | =6.7-670-201904210 | |
| VMware ESXi | =6.7-670-201904211 | |
| VMware ESXi | =6.7-670-201904212 | |
| VMware ESXi | =6.7-670-201904213 | |
| VMware ESXi | =6.7-670-201904214 | |
| VMware ESXi | =6.7-670-201904215 | |
| VMware ESXi | =6.7-670-201904216 | |
| VMware ESXi | =6.7-670-201904217 | |
| VMware ESXi | =6.7-670-201904218 | |
| VMware ESXi | =6.7-670-201904219 | |
| VMware ESXi | =6.7-670-201904220 | |
| VMware ESXi | =6.7-670-201904221 | |
| VMware ESXi | =6.7-670-201904222 | |
| VMware ESXi | =6.7-670-201904223 | |
| VMware ESXi | =6.7-670-201904224 | |
| VMware ESXi | =6.7-670-201904225 | |
| VMware ESXi | =6.7-670-201904226 | |
| VMware ESXi | =6.7-670-201904227 | |
| VMware ESXi | =6.7-670-201904228 | |
| VMware ESXi | =6.7-670-201904229 | |
| VMware ESXi | =6.7-670-201905001 | |
| VMware ESXi | =6.7-670-201906002 | |
| VMware ESXi | =6.7-670-201908101 | |
| VMware ESXi | =6.7-670-201908102 | |
| VMware ESXi | =6.7-670-201908103 | |
| VMware ESXi | =6.7-670-201908104 | |
| VMware ESXi | =6.7-670-201908201 | |
| VMware ESXi | =6.7-670-201908202 | |
| VMware ESXi | =6.7-670-201908203 | |
| VMware ESXi | =6.7-670-201908204 | |
| VMware ESXi | =6.7-670-201908205 | |
| VMware ESXi | =6.7-670-201908206 | |
| VMware ESXi | =6.7-670-201908207 | |
| VMware ESXi | =6.7-670-201908208 | |
| VMware ESXi | =6.7-670-201908209 | |
| VMware ESXi | =6.7-670-201908210 | |
| VMware ESXi | =6.7-670-201908211 | |
| VMware ESXi | =6.7-670-201908212 | |
| VMware ESXi | =6.7-670-201908213 | |
| VMware ESXi | =6.7-670-201908214 | |
| VMware ESXi | =6.7-670-201908215 | |
| VMware ESXi | =6.7-670-201908216 | |
| VMware ESXi | =6.7-670-201908217 | |
| VMware ESXi | =6.7-670-201908218 | |
| VMware ESXi | =6.7-670-201908219 | |
| VMware ESXi | =6.7-670-201908220 | |
| VMware ESXi | =6.7-670-201908221 | |
| VMware ESXi | =6.7-670-201912001 | |
| VMware ESXi | =6.7-670-201912101 | |
| VMware ESXi | =6.7-670-201912102 | |
| VMware ESXi | =6.7-670-201912401 | |
| VMware ESXi | =6.7-670-201912402 | |
| VMware ESXi | =6.7-670-201912403 | |
| VMware ESXi | =6.7-670-201912404 | |
| VMware ESXi | =6.7-670-201912405 | |
| VMware ESXi | =6.7-670-202004001 | |
| VMware ESXi | =6.7-670-202004002 | |
| VMware ESXi | =7.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2020-3969?
CVE-2020-3969 is classified as a high-severity vulnerability due to its potential for privilege escalation.
How do I fix CVE-2020-3969?
To fix CVE-2020-3969, you should apply the latest security updates provided by VMware for affected products.
What affected software versions are at risk from CVE-2020-3969?
CVE-2020-3969 affects VMware Workstation, Cloud Foundation, Fusion Pro, and various ESXi versions, particularly those before specific patched releases.
Can local attackers exploit CVE-2020-3969 easily?
Yes, local attackers can exploit CVE-2020-3969 if they have already gained low-privileged access to the affected guest system.
What types of installations are impacted by CVE-2020-3969?
CVE-2020-3969 impacts installations of VMware Workstation, Cloud Foundation, Fusion Pro, and multiple ESXi versions.
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/author
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/trending
- agent/source
- collector/zdi-advisory
- source/ZDI
- alias/ZDI-20-786
- alias/ZDI-CAN-10891
- alias/CVE-2020-3969
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/event
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- vendor/vmware
- canonical/vmware workstation
- canonical/vmware vcenter server and cloud foundation
- version/vmware vcenter server and cloud foundation/3.0
- version/vmware vcenter server and cloud foundation/4.0.0
- canonical/vmware fusion pro
- version/vmware fusion pro/11.0.0
- version/vmware workstation/15.0.0
- canonical/vmware esxi
- version/vmware esxi/6.5
- version/vmware esxi/6.5-650-201701001
- version/vmware esxi/6.5-650-201703001
- version/vmware esxi/6.5-650-201703002
- version/vmware esxi/6.5-650-201704001
- version/vmware esxi/6.5-650-201707101
- version/vmware esxi/6.5-650-201707102
- version/vmware esxi/6.5-650-201707103
- version/vmware esxi/6.5-650-201707201
- version/vmware esxi/6.5-650-201707202
- version/vmware esxi/6.5-650-201707203
- version/vmware esxi/6.5-650-201707204
- version/vmware esxi/6.5-650-201707205
- version/vmware esxi/6.5-650-201707206
- version/vmware esxi/6.5-650-201707207
- version/vmware esxi/6.5-650-201707208
- version/vmware esxi/6.5-650-201707209
- version/vmware esxi/6.5-650-201707210
- version/vmware esxi/6.5-650-201707211
- version/vmware esxi/6.5-650-201707212
- version/vmware esxi/6.5-650-201707213
- version/vmware esxi/6.5-650-201707214
- version/vmware esxi/6.5-650-201707215
- version/vmware esxi/6.5-650-201707216
- version/vmware esxi/6.5-650-201707217
- version/vmware esxi/6.5-650-201707218
- version/vmware esxi/6.5-650-201707219
- version/vmware esxi/6.5-650-201707220
- version/vmware esxi/6.5-650-201707221
- version/vmware esxi/6.5-650-201710001
- version/vmware esxi/6.5-650-201712001
- version/vmware esxi/6.5-650-201803001
- version/vmware esxi/6.5-650-201806001
- version/vmware esxi/6.5-650-201808001
- version/vmware esxi/6.5-650-201810001
- version/vmware esxi/6.5-650-201810002
- version/vmware esxi/6.5-650-201811001
- version/vmware esxi/6.5-650-201811002
- version/vmware esxi/6.5-650-201811301
- version/vmware esxi/6.5-650-201901001
- version/vmware esxi/6.5-650-201903001
- version/vmware esxi/6.5-650-201905001
- version/vmware esxi/6.5-650-201908001
- version/vmware esxi/6.5-650-201910001
- version/vmware esxi/6.5-650-20191004001
- version/vmware esxi/6.5-650-201911001
- version/vmware esxi/6.5-650-201911401
- version/vmware esxi/6.5-650-201911402
- version/vmware esxi/6.5-650-201912001
- version/vmware esxi/6.5-650-201912002
- version/vmware esxi/6.5-650-201912101
- version/vmware esxi/6.5-650-201912102
- version/vmware esxi/6.5-650-201912103
- version/vmware esxi/6.5-650-201912104
- version/vmware esxi/6.5-650-201912301
- version/vmware esxi/6.5-650-201912401
- version/vmware esxi/6.5-650-201912402
- version/vmware esxi/6.5-650-201912403
- version/vmware esxi/6.5-650-201912404
- version/vmware esxi/6.5-650-202005001
- version/vmware esxi/6.7
- version/vmware esxi/6.7-670-201806001
- version/vmware esxi/6.7-670-201807001
- version/vmware esxi/6.7-670-201808001
- version/vmware esxi/6.7-670-201810001
- version/vmware esxi/6.7-670-201810101
- version/vmware esxi/6.7-670-201810102
- version/vmware esxi/6.7-670-201810103
- version/vmware esxi/6.7-670-201810201
- version/vmware esxi/6.7-670-201810202
- version/vmware esxi/6.7-670-201810203
- version/vmware esxi/6.7-670-201810204
- version/vmware esxi/6.7-670-201810205
- version/vmware esxi/6.7-670-201810206
- version/vmware esxi/6.7-670-201810207
- version/vmware esxi/6.7-670-201810208
- version/vmware esxi/6.7-670-201810209
- version/vmware esxi/6.7-670-201810210
- version/vmware esxi/6.7-670-201810211
- version/vmware esxi/6.7-670-201810212
- version/vmware esxi/6.7-670-201810213
- version/vmware esxi/6.7-670-201810214
- version/vmware esxi/6.7-670-201810215
- version/vmware esxi/6.7-670-201810216
- version/vmware esxi/6.7-670-201810217
- version/vmware esxi/6.7-670-201810218
- version/vmware esxi/6.7-670-201810219
- version/vmware esxi/6.7-670-201810220
- version/vmware esxi/6.7-670-201810221
- version/vmware esxi/6.7-670-201810222
- version/vmware esxi/6.7-670-201810223
- version/vmware esxi/6.7-670-201810224
- version/vmware esxi/6.7-670-201810225
- version/vmware esxi/6.7-670-201810226
- version/vmware esxi/6.7-670-201810227
- version/vmware esxi/6.7-670-201810228
- version/vmware esxi/6.7-670-201810229
- version/vmware esxi/6.7-670-201810230
- version/vmware esxi/6.7-670-201810231
- version/vmware esxi/6.7-670-201810232
- version/vmware esxi/6.7-670-201810233
- version/vmware esxi/6.7-670-201810234
- version/vmware esxi/6.7-670-201811001
- version/vmware esxi/6.7-670-201901001
- version/vmware esxi/6.7-670-201901401
- version/vmware esxi/6.7-670-201901402
- version/vmware esxi/6.7-670-201901403
- version/vmware esxi/6.7-670-201903001
- version/vmware esxi/6.7-670-201904001
- version/vmware esxi/6.7-670-201904201
- version/vmware esxi/6.7-670-201904202
- version/vmware esxi/6.7-670-201904203
- version/vmware esxi/6.7-670-201904204
- version/vmware esxi/6.7-670-201904205
- version/vmware esxi/6.7-670-201904206
- version/vmware esxi/6.7-670-201904207
- version/vmware esxi/6.7-670-201904208
- version/vmware esxi/6.7-670-201904209
- version/vmware esxi/6.7-670-201904210
- version/vmware esxi/6.7-670-201904211
- version/vmware esxi/6.7-670-201904212
- version/vmware esxi/6.7-670-201904213
- version/vmware esxi/6.7-670-201904214
- version/vmware esxi/6.7-670-201904215
- version/vmware esxi/6.7-670-201904216
- version/vmware esxi/6.7-670-201904217
- version/vmware esxi/6.7-670-201904218
- version/vmware esxi/6.7-670-201904219
- version/vmware esxi/6.7-670-201904220
- version/vmware esxi/6.7-670-201904221
- version/vmware esxi/6.7-670-201904222
- version/vmware esxi/6.7-670-201904223
- version/vmware esxi/6.7-670-201904224
- version/vmware esxi/6.7-670-201904225
- version/vmware esxi/6.7-670-201904226
- version/vmware esxi/6.7-670-201904227
- version/vmware esxi/6.7-670-201904228
- version/vmware esxi/6.7-670-201904229
- version/vmware esxi/6.7-670-201905001
- version/vmware esxi/6.7-670-201906002
- version/vmware esxi/6.7-670-201908101
- version/vmware esxi/6.7-670-201908102
- version/vmware esxi/6.7-670-201908103
- version/vmware esxi/6.7-670-201908104
- version/vmware esxi/6.7-670-201908201
- version/vmware esxi/6.7-670-201908202
- version/vmware esxi/6.7-670-201908203
- version/vmware esxi/6.7-670-201908204
- version/vmware esxi/6.7-670-201908205
- version/vmware esxi/6.7-670-201908206
- version/vmware esxi/6.7-670-201908207
- version/vmware esxi/6.7-670-201908208
- version/vmware esxi/6.7-670-201908209
- version/vmware esxi/6.7-670-201908210
- version/vmware esxi/6.7-670-201908211
- version/vmware esxi/6.7-670-201908212
- version/vmware esxi/6.7-670-201908213
- version/vmware esxi/6.7-670-201908214
- version/vmware esxi/6.7-670-201908215
- version/vmware esxi/6.7-670-201908216
- version/vmware esxi/6.7-670-201908217
- version/vmware esxi/6.7-670-201908218
- version/vmware esxi/6.7-670-201908219
- version/vmware esxi/6.7-670-201908220
- version/vmware esxi/6.7-670-201908221
- version/vmware esxi/6.7-670-201912001
- version/vmware esxi/6.7-670-201912101
- version/vmware esxi/6.7-670-201912102
- version/vmware esxi/6.7-670-201912401
- version/vmware esxi/6.7-670-201912402
- version/vmware esxi/6.7-670-201912403
- version/vmware esxi/6.7-670-201912404
- version/vmware esxi/6.7-670-201912405
- version/vmware esxi/6.7-670-202004001
- version/vmware esxi/6.7-670-202004002
- version/vmware esxi/7.0.0