Vulnerability · Published May 29, 2020 · Assigned by vmware

CVE-2020-3957

High 7.0

In plain English

A high-severity security flaw in VMware Fusion from VMware. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS NVD)7.0High

Exploit odds (30 days)0.2%top 87.7% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

VMware Fusion (11.x before 11.5.5), VMware Remote Console for Mac (11.x and prior) and VMware Horizon Client for Mac (5.x and prior) contain a local privilege escalation vulnerability due to a Time-of-check Time-of-use (TOCTOU) issue in the service opener. Successful exploitation of this issue may allow attackers with normal user privileges to escalate their privileges to root on the system where Fusion, VMRC and Horizon Client are installed.

Affected products (as reported)

Vendor	Product	Versions
VMware	VMware Fusion	11.x before 11.5.5
VMware	VMware Remote Console for Mac	V11.x and prior
VMware	VMware Horizon Client for Mac	5.x and prior

References

https://www.vmware.com/security/advisories/VMSA-2020-0011.html x_refsource_CONFIRM