CVE-2020-3971: Medium severity vmware vcenter server and cloud foundation vulnerability
VMware ESXi (6.7 before ESXi670-201904101-SG and 6.5 before ESXi650-201907101-SG), Workstation (15.x before 15.0.2), and Fusion (11.x before 11.0.2) contain a heap overflow vulnerability in the vmxnet3 virtual network adapter. A malicious actor with local access to a virtual machine with a vmxnet3 network adapter present may be able to read privileged information contained in physical memory.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-3971?
CVE-2020-3971 is classified as important due to its potential to allow local attackers to execute arbitrary code.
How do I fix CVE-2020-3971?
To fix CVE-2020-3971, upgrade to the patched versions of VMware ESXi 6.7, 6.5, Workstation 15.x, or Fusion 11.x.
What types of systems are affected by CVE-2020-3971?
CVE-2020-3971 affects VMware ESXi, VMware Workstation, and VMware Fusion versions prior to their respective patched releases.
Can CVE-2020-3971 be exploited remotely?
No, CVE-2020-3971 requires local access to the virtual machine for exploitation.
What is the impact of not addressing CVE-2020-3971?
Failing to address CVE-2020-3971 could allow a malicious user with access to the virtual machine to execute arbitrary code, potentially compromising the system.