Vulnerability in Vmware Esxi
CVE-2018-6977
VMware ESXi (6.7, 6.5, 6.0), Workstation (15.x and 14.x) and Fusion (11.x and 10.x) contain a denial-of-service vulnerability due to an infinite loop in a 3D-rendering shader. Successfully exploiting this issue may allow an attacker with normal user privileges in the guest to make the VM unresponsive, and in some cases, possibly result other VMs on the host or the host itself becoming unresponsive.
EPSS: 0.004 (35.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H.
Affected products
- Vmware Esxi — versions 6.7, 6.5, 6.0
- Vmware Fusion — versions 11.x and 10.x
- Vmware Workstation — versions 15.x and 14.x
Weakness classification (CWE)
References
- security@vmware.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- security@vmware.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK)
- security@vmware.com (x_refsource_CONFIRM, Mitigation, Vendor Advisory)
- security@vmware.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK)
Frequently asked questions
- What is CVE-2018-6977?
- CVE-2018-6977 is a medium-severity vulnerability in Vmware Esxi, classified under Loop with Unreachable Exit Condition (Infinite Loop). CVSS score: 6.5/10. Published 2018-10-09.
- How severe is CVE-2018-6977?
- Medium severity. CVSS v3 base score is 6.5 out of 10.