VMware on Friday informed customers that two potentially serious pixel shader vulnerabilities have been patched in its ESXi, Workstation and Fusion products, including one caused by a flaw in an NVIDIA graphics driver.
The more serious of the security holes, CVE-2019-5684, has been described as an out-of-bounds write bug that can allow arbitrary code execution on the host. This flaw affects systems using NVIDIA display drivers for Windows.
Piotr Bania of Cisco Talos has been credited by NVIDIA and VMware for reporting this vulnerability, which NVIDIA has classified as “high severity” with a CVSS score of 7.8. Updates released last week by NVIDIA for its GPU Display Driver patch this weakness.
“NVIDIA Windows GPU Display Driver contains a vulnerability in DirectX drivers, in which a specially crafted shader can cause an out of bounds access of an input texture array, which may lead to denial of service or code execution,” NVIDIA wrote in its advisory.
In addition, NVIDIA has addressed two other high-severity and two medium-severity vulnerabilities in its Windows GPU Display Driver.
VMware, which assigned a CVSS score of 8.5 to CVE-2019-5684 and a severity rating of “important,” told customers that they can prevent attacks by installing its own patches for ESXi, Workstation and Fusion, or by installing the updated graphics driver from NVIDIA.
Bania also informed VMware of CVE-2019-5521, an out-of-bounds read issue whose exploitation can lead to information disclosure or a denial-of-service (DoS) condition on the host.
VMware pointed out that exploitation of CVE-2019-5684 and CVE-2019-5521 requires access to the targeted virtual mach ..
Support the originator by clicking the read the rest link below.
