CVE-2020-3950
VMware Multiple Products Privilege Escalation Vulnerability
Description
CVE-2020-3950 is a high-severity privilege escalation vulnerability affecting multiple VMware products for macOS, including VMware Fusion, Remote Console (VMRC) for Mac, and Horizon Client for Mac. The vulnerability arises from improper use of setuid binaries, which allows an attacker with normal user privileges to escalate to root-level access on the host system. CISA has added CVE-2020-3950 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 19.65% (95.3rd percentile), this VMware privilege escalation vulnerability has a high probability of being exploited.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| vmware | fusion | >= 11.0.0, < 11.5.2 |
| vmware | horizon client | >= 5.0.0, < 5.4.0 |
| vmware | remote console | >= 11.0.0, < 11.0.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/156843/VMware-Fusion-11.5.2-Privilege-Escalation.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/157079/VMware-Fusion-USB-Arbitrator-Setuid-Privilege-Escalation.html(Exploit, Third Party Advisory, VDB Entry)
- https://www.vmware.com/security/advisories/VMSA-2020-0005.html(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3950(US Government Resource)
Weakness Type
CWE-269: Improper Privilege Management
Improper Privilege Management occurs when a product does not properly assign, modify, track, or check privileges for actors. In the case of CVE-2020-3950, VMware Fusion, VMRC, and Horizon Client for Mac improperly configured setuid binaries, allowing local users to exploit the elevated privileges of these binaries to gain root access on the underlying macOS system.
Learn more: CWE-269 — Improper Privilege Management
Impact Analysis
CVE-2020-3950 carries a CVSS 3.1 score of 7.8 (HIGH), reflecting a serious local privilege escalation threat. The vulnerability requires local access to the system and low-level user privileges, but exploitation is straightforward with low attack complexity and no user interaction required. Confidentiality (High): A successful exploit grants root-level access, enabling the attacker to read all data on the system including sensitive files and credentials. Integrity (High): With root privileges, an attacker can modify any file on the system, install backdoors, or tamper with VMware configurations. Availability (High): Full system control allows the attacker to disrupt services, shut down virtual machines, or render the host system inoperable. The EPSS score of 19.65% indicates a significant likelihood of active exploitation, making immediate remediation critical for organizations running affected VMware products on macOS.
Exploit Maturity
CVE-2020-3950 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog. Public exploit code is available for this vulnerability via Packet Storm Security and a USB Arbitrator setuid exploit, significantly lowering the barrier for attackers. The EPSS score of 19.65% (95.3rd percentile) indicates a high probability of exploitation activity. Federal agencies were required to remediate this vulnerability by 2022-05-03 per CISA binding operational directive.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Update VMware Fusion to version 11.5.2 or later, VMware Remote Console for Mac to version 11.0.1 or later, and VMware Horizon Client for Mac to version 5.4.0 or later.
- Verify that all macOS systems running affected VMware products (VMware Fusion >= 11.0.0 and < 11.5.2, Horizon Client >= 5.0.0 and < 5.4.0, Remote Console >= 11.0.0 and < 11.0.1) have been updated to patched versions.
- Audit setuid binaries on affected macOS systems to ensure no unauthorized modifications have been made. Remove or restrict unnecessary setuid permissions on VMware-related binaries as an interim measure.
- Monitor local system logs for indicators of privilege escalation attempts, including unexpected root-level process execution originating from VMware binaries and unauthorized file modifications.
- Implement least-privilege access controls on macOS systems running VMware products, ensuring that only authorized users have local access and that role-based access control is enforced to limit the potential impact of exploitation.
Technical Details
CVE-2020-3950 stems from improper privilege management in VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1), and Horizon Client for Mac (5.x and prior before 5.4.0). The vulnerability is caused by the insecure use of setuid binaries, which are executables that run with the file owner’s privileges (typically root) regardless of the invoking user. An attacker with normal user-level access can exploit the misconfigured setuid binaries to escalate privileges to root on the macOS host. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that this is a local attack vector requiring low privileges and low complexity, with no user interaction needed, resulting in complete compromise of confidentiality, integrity, and availability within the vulnerable component.
Frequently Asked Questions
Is CVE-2020-3950 being actively exploited?
Yes. CVE-2020-3950 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation. The EPSS score of 19.65% (95.3rd percentile) further indicates a high probability of exploitation. There is no known association with ransomware campaigns at this time.
What products are affected by CVE-2020-3950?
CVE-2020-3950 affects VMware Fusion (versions 11.x before 11.5.2), VMware Remote Console for Mac (versions 11.x and prior before 11.0.1), and VMware Horizon Client for Mac (versions 5.x and prior before 5.4.0). All three products are affected on macOS platforms.
How do I fix CVE-2020-3950?
Apply updates per vendor instructions. Upgrade VMware Fusion to 11.5.2+, Remote Console for Mac to 11.0.1+, and Horizon Client for Mac to 5.4.0+. If immediate patching is not possible, restrict local user access and audit setuid binaries on affected systems.
How severe is CVE-2020-3950?
CVE-2020-3950 has a CVSS 3.1 score of 7.8 (HIGH). It allows local privilege escalation to root through misuse of setuid binaries. The EPSS score of 19.65% places it in the 95.3rd percentile, indicating a significant likelihood of exploitation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.