CVE-2016-7461 code execution flaw affects VMware Workstation
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2016-5195 | Dirty COW Race Condition Enables Local Privilege Escalation in the Linux Kernel CVE-2016-5195, widely known as 'Dirty COW', is a race condition (CWE-362) in the copy-on-write (COW) memory-handling code in mm/gup.c of the Linux kernel, affecting kernel versions 2.x through 4.x before 4.8.3. A local user with low privileges can trigger the race — including via the PTRACE_POKEDATA path used in public exploits — to write to a read-only memory mapping that should not be writable, corrupting files or overwriting memory. This yields root-level privileges on the host, enabling full system takeover, malware implantation and persistence. Any system running an affected kernel is exposed, spanning Ubuntu, Red Hat Enterprise Linux (including AUS, EUS, Long Life and TUS variants), Debian, Fedora, Palo Alto Networks PAN-OS, and NetApp Cloud Backup and HCI Storage Nodes that ship an affected kernel. Exploitation is confirmed in the wild: the flaw was actively exploited in October 2016, including by the first Android malware found using it to gain root, it was added to CISA's KEV catalog on 2022-03-03 with the required action to apply vendor updates, and EPSS currently assigns an 83.5% probability of exploitation in the next 30 days (100th percentile). Do: Upgrade to Linux kernel 4.8.3 or later, or apply the vendor-issued patched/backported kernel updates from Canonical, Red Hat, Debian, Fedora Project, Palo Alto Networks (PAN-OS) and NetApp, per the CISA KEV required action. Prioritize unpatched legacy servers and internet-exposed Linux hosts — especially multi-user systems, SSH-accessible machines and containers where untrusted users can run code — and update Android devices that may have been silently rooted via Dirty COW. Until patching completes, restrict local and SSH access to trusted users, since exploitation requires local low-privileged code execution. | 7.0 | 84% | KEV PoC ×5 |
| mass≈ hundreds of millions of Linux systems and devices (affected kernels shipped in nearly all mainstream distributions, appliances and Android devices of the… | |
| CVE-2016-7461 | The drag-and-drop (aka DnD) function in VMware Workstation Pro 12.x before 12.5.2 and VMware Workstation Player 12.x before 12.5.2 and VMware Fusion and Fusion The drag-and-drop (aka DnD) function in VMware Workstation Pro 12.x before 12.5.2 and VMware Workstation Player 12.x before 12.5.2 and VMware Fusion and Fusion Pro 8.x before 8.5.2 allows guest OS users to execute arbitrary code on the host OS or cause a denial of service (out-of-bounds memory access on the host OS) via unspecified vectors. NVD description · AI analysis pending | 8.8 | <1% |
| — |
Full article319 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
November 15, 2016
VMware has patched a critical out-of-bounds memory access vulnerability, tracked as CVE-2016-7461, affecting its Workstation and Fusion products.
The flaw, that resides in the affects the drag-and-drop function, can be exploited by attackers to execute arbitrary code on the host operating system running Fusion or Workstation.
The security vulnerability affects Workstation Player and Pro 12.x, and Fusion (Pro) 8.x., while the ESXi is not affected.
The flaw war reported hacking contest 2016 PwnFest held in South Korea at the 2016 Power Of Community (POC) security conference. The hackers earned $140,000 for the Windows Edge hacks, while Qihoo hacker team and Lee earned $150,000 for the hack of the VMware Workstation 12.5.1.
VMware patched the vulnerability with the release of versions 12.5.2 and 8.5.2.
“Problem Description
a. VMware Workstation and Fusion out-of-bounds memory access vulnerability
The drag-and-drop (DnD) function in VMware Workstation and Fusion has an out-of-bounds memory access vulnerability. This may allow a guest to execute code on the operating system that runs Workstation or Fusion.” states the advisory published by VMware.
VMware explained that the flaw cannot be exploited against Workstation Pro or Fusion when both the drag-and-drop and copy-and-paste functions are disabled, while it remains exploitable on Workstation Player.
Recently VMware released several security updates to fix the local privilege escalation flaw in Linux kernel, also known as Dirty COW, tracked as CVE-2016-5195.
“The Linux kernel which ships with the base operating system of VMware Appliances contains a race condition in the way its memory subsystem handles copy-on-write (aka “Dirty COW”). Successful exploitation of the vulnerability may allow for local privilege escalation. The product lines listed in this advisory have been confirmed to be affected.” reads the advisory from VMmware.com.
Security patches for Identity Manager, vRealize Automation and version 5.x of vRealize Operations are still pending.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(Security Affairs – CVE-2016-7461, VMware)
[adrotate banner=”9″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/53431/hacking/vmware-cve-2016-7461.html