<<< Date Index >>>     <<< Thread Index >>>

security vulnerability in VMware



vulnerable software: VMware Workstation 6.0 for Windows, possible some other 
VMware products as well
type of vulnerability: DoS, potential privilege escalation

I found a vulnerability in VMware Workstation 6.0 which allows an unprivileged 
user in the host OS to crash the system and potentially run arbitrary code with 
kernel privileges.

The issue is in the vmstor-60 driver, which is supposed to mount VMware images 
within the host OS. When sending the IOCTL code FsSetVoleInformation with 
subcode FsSetFileInformation with a large buffer and underreporting its size to 
at max 1024 bytes, it will underrun and potentially execute arbitrary code.

Interestingly the vmstor driver (which is the old version supposed to mount 
VMware images prior to version 6.0) is not vulnerable.

I have originally reported this vulnerability on 21-May-07 and got response 
from the VMware security team, but so far the investigation hasn't gone any 
further and no update has been released.

how to reproduce:

- get DC2.exe from the latest Windows Driver Kit
- login as unprivileged user
- run "dc2 /hct \Device\vstor-ws60"

workaround:

Disable the vstor-ws60 driver in the device manager. This will disable the 
VMware Virtual Image Mounter.