Vulnerability in VMware Esxi
CVE-2018-6977
VMware ESXi (6.7, 6.5, 6.0), Workstation (15.x and 14.x) and Fusion (11.x and 10.x) contain a denial-of-service vulnerability due to an infinite loop in a 3D-rendering shader. Successfully exploiting this issue may allow an attacker with normal user privileges in the guest to make the VM unresponsive, and in some cases, possibly result other VMs on the host or the host itself becoming unresponsive.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.004 (34.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 35th percentile — 34.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
- VMware Esxi — versions 6.7, 6.5, 6.0
- VMware Fusion — versions 11.x and 10.x
- VMware Workstation — versions 15.x and 14.x
Weakness classification (CWE)
References
- www.securityfocus.com/bid/105549 (VDB Entry, Third Party Advisory, vdb-entry)
- www.securitytracker.com/id/1041821 (VDB Entry, Third Party Advisory, vdb-entry)
- www.vmware.com/security/advisories/VMSA-2018-0025.html (Mitigation, Vendor Advisory)
- www.securitytracker.com/id/1041822 (VDB Entry, Third Party Advisory, vdb-entry)
Frequently asked questions
- What is CVE-2018-6977?
- CVE-2018-6977 is a medium-severity vulnerability in VMware Esxi, classified under Loop with Unreachable Exit Condition (Infinite Loop). CVSS score: 6.5/10. Published 2018-10-09.
- How severe is CVE-2018-6977?
- Medium severity. CVSS v3 base score is 6.5 out of 10.