CVE-2020-3992

CRITICAL9.8Memory safety

CISA KEVRansomwareHigh EPSS

Description

OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a use-after-free issue. A malicious actor residing in the management network who has access to port 427 on an ESXi machine may be able to trigger a use-after-free in the OpenSLP service resulting in remote code execution.

CVSS breakdown

CVSS 3.1

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected products

VMware / Cloud Foundation3.0 – 3.10.1.2
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.5 – 6.5
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi6.7 – 6.7
VMware / ESXi7.0.0 – 7.0.0
VMware / ESXi6.5 – 6.5
VMware / ESXi7.0.0 – 7.0.0

References

VENDOR_ADVISORYhttps://www.vmware.com/security/advisories/VMSA-2020-0023.html
VENDOR_ADVISORYhttps://www.zerodayinitiative.com/advisories/ZDI-20-1377/
VENDOR_ADVISORYhttps://www.zerodayinitiative.com/advisories/ZDI-20-1385/

Updated 28m ago · 8 sources