vmware cloud-foundation CVE-2020-3992 vulnerability in VMware Products
Published on October 20, 2020

OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a use-after-free issue. A malicious actor residing in the management network who has access to port 427 on an ESXi machine may be able to trigger a use-after-free in the OpenSLP service resulting in remote code execution.

Vendor Advisory NVD

Known Exploited Vulnerability

This OpenSLP as used in VMware ESXi vulnerability is part of CISA's list of Known Exploited Vulnerabilities. OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a use-after-free issue. A malicious actor residing in the management network who has access to port 427 on an ESXi machine may be able to trigger a use-after-free in the OpenSLP service resulting in remote code execution.

The following remediation steps are recommended / required by May 3, 2022: Apply updates per vendor instructions.

Vulnerability Analysis

CVE-2020-3992 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. It has the highest possible exploitability rating (3.9). The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.

What is a Dangling pointer Vulnerability?

Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.

CVE-2020-3992 has been classified to as a Dangling pointer vulnerability or weakness.


Products Associated with CVE-2020-3992

You can be notified by stack.watch whenever vulnerabilities like CVE-2020-3992 are published in these products:

VMware Cloud Foundation
 
VMware Esxi
 

What versions are vulnerable to CVE-2020-3992?