CVE-2020-4004

Published Nov 20, 2020 CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Description
VMware ESXi (7.0 before ESXi70U1b-17168206, 6.7 before ESXi670-202011101-SG, 6.5 before ESXi650-202011301-SG), Workstation (15.x before 15.5.7), Fusion (11.x before 11.5.7) contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2020-25269 VMware ESXi (7.0 before ESXi70U1b-17168206, 6.7 before ESXi670-202011101-SG, 6.5 before ESXi650-202011301-SG), Workstation (15.x before 15.5.7), Fusion (11.x before 11.5.7) contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.
History
Type Values Removed Values Added
CPEs cpe:2.3:o:vmware:cloud_foundation:*:*:*:*:*:*:*:*
Weaknesses

Sources

Status
PUBLISHED
Assigner
vmware
Published
Updated
Aug 4, 2024, 7:52 AM
Reserved
Dec 30, 2019, 12:00 AM
Status
Modified
Published
Nov 20, 2020, 8:15 PM
Modified
Jun 17, 2026, 3:19 AM