VMware plugs critical hypervisor holes

Virtualisation software vendor VMwware has issued patches for a range of vulnerabilities in three of its key products that allow malicious guests to run arbitrary code on their hosts.

In its security advisory, VMware said the patches fix critical flaws in its ESXI hypervisor product, versions 5.5, 6.0 U1, U2 and U3, and 6.5. Its Fusion 8.x and Workstation 12.x virtual machines have also received patches for critical vulnerabilities.

One flaw takes advantage of a memory corruption bug in the SVGA video subsystem in ESXI, Workstation and Fusion products that allows attackers to execute code on hosts via guests, VMWare said.

The extensible host controller interface (XHCI) that handles USB devices in the above products contains a bug that leads to uninitialised memory usage. 

Again, this flaw can be exploited to allow guests to escape and run code on VMware hosts.

However, the vulnerability can only be used for denial of service attacks on the older ESXI 5.5 hypervisor.

VMware also issued patches for an information leak issue in ESXI, Workstation and Fusion, caused by uninitialised memory usage in the three products.

The company rated the information leak bug severity as moderate.