⚠ Actively exploited in ransomware campaigns
This vulnerability is on the CISA Known Exploited Vulnerabilities list and has been used in known ransomware attacks. CISA required action: Apply updates per vendor instructions.. Due date: 2022-05-03.

CVE-2020-3992 — Use After Free in Vmware Cloud Foundation

CWE-416 — Use After Free7 documents7 sources
Severity
9.8CRITICALNVD
EPSS
90.9%
top 0.37%
CISA KEV
KEVRansomware
Added 2021-11-03
Due 2022-05-03
Exploit
Exploited in wild
Active exploitation observed
Affected products
3
Vmware Cloud FoundationVmware EsxiVmware Esxi
Timeline
PublishedOct 20
KEV addedNov 3
KEV dueMay 3
Latest updateMay 24
CISA Required Action: Apply updates per vendor instructions.

Description

OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a use-after-free issue. A malicious actor residing in the management network who has access to port 427 on an ESXi machine may be able to trigger a use-after-free in the OpenSLP service resulting in remote code execution.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages3 packages

▶NVDvmware/esxi6.5, 6.7, 7.0.0+2
▶CVEListV5vmware/vmware_esxiVMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG)
▶NVDvmware/cloud_foundation3.0 — 3.10.1.2+1

Patches

Patch: www.vmware.com ↗Patch: www.vmware.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-58ff-49fr-3jwf: OpenSLP as used in VMware ESXi (7↗2022-05-24
▶
CVEList
CVE-2020-3992: OpenSLP as used in VMware ESXi (7↗2020-10-20
▶
VulnCheck
VMware ESXi OpenSLP Use-After-Free Vulnerability↗2020
▶

📋Vendor Advisories

3
CISA
VMware ESXi OpenSLP Use-After-Free Vulnerability↗2021-11-03
▶
Microsoft
Microsoft Word Security Feature Bypass Vulnerability↗2020-11-10
▶
VMware
VMware ESXi, Workstation, Fusion and NSX-T updates address multiple security vulnerabilities (CVE-2020-3981, CVE-2020-3982, CVE-2020-3992, CVE-2020-3993, CVE-2020-3994, CVE-2020-3995)↗2020-10-20
▶
CVE-2020-3992 — Use After Free in Vmware | cvebase