GitHub is now a VMware virtual machine escape exp, leveraging March exposure to cve-2017-4901 vulnerabilities

After this year's Pwn2Own competition, VMware recently released updates for its ESXi, wordstation, and fusion products to fix some of the high-risk vulnerabilities uncovered in the hacker contest. In fact, before the tournament began, VMware urgently repaired a virtual machine escape vulnerability numbered cve-2017-4901.

And recently, someone on GitHub unveiled a VMware Virtual machine escape utility, which is the cve-2017-4901, which is capable of attacking 12.5. VMware WorkStation before version 5, the target host is Windows x64. The compiler used by the exploit tool is visual Studio 2013. The VMware version tested by the author is the VMware 12.5.2 build-4638234.

This tool exploits a escaping vulnerability in the Pwn2Own contest, numbered cve-2017-4901. March 14 this year, the official VMware has been updated.

Although the uploader did not release the identity, the map can be inferred that the uploader may have come from China. Interested students can click here to test. If you're having problems restarting VMware after running a test program inside a virtual machine, remember to delete the. lck folder under the VM directory or use the script here to complete the operation. The following is a brief description of the vulnerability:

Vulnerability number

cve-2017-4901

vmsa-2017-0005

Impact Range

VMware Workstation Pro/player (prior to 12.5.5 version)

VMware Fusion pro/fusion

Vulnerability Rating

Critical (Critical)

Vulnerability Details

Drag-and-drop (DnD) features in VMware Workstation and fusion contain out-of-bounds memory access vulnerabilities. This allows the guest to execute code on the operating system running workstation or fusion.

Remediation Scenarios

Update to new version

From the diagram on GitHub, the attacker could successfully open the calculator in the host after launching the program in VMware, causing the virtual machine to escape.

GitHub is now a VMware virtual machine escape exp, leveraging March exposure to cve-2017-4901 vulnerabilities