CVE-2020-3992
VMware ESXi OpenSLP Use-After-Free Vulnerability
Description
CVE-2020-3992 is a critical use-after-free vulnerability in the OpenSLP implementation used by VMware ESXi. The vulnerability allows a malicious actor residing in the management network with access to port 427 on an ESXi machine to trigger a use-after-free condition in the OpenSLP service, resulting in remote code execution. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild, including known use in ransomware campaigns. With an EPSS score of 85.76% (99.37th percentile), this VMware ESXi vulnerability has a very high probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| vmware | cloud foundation | >= 3.0, < 3.10.1.2; >= 4.0, < 4.1.0.1 |
| vmware | esxi | 6.5; 6.7; 7.0.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.vmware.com/security/advisories/VMSA-2020-0023.html(Patch, Vendor Advisory)
- https://www.zerodayinitiative.com/advisories/ZDI-20-1377/(Third Party Advisory, VDB Entry)
- https://www.zerodayinitiative.com/advisories/ZDI-20-1385/(Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3992(US Government Resource)
Weakness Type
CWE-416: Use After Free
Use After Free (UAF) is a vulnerability that occurs when software continues to use a pointer after the memory it references has been freed. In the case of CVE-2020-3992, the OpenSLP service in VMware ESXi contains a use-after-free condition that can be triggered by an attacker with management network access to port 427. When the dangling pointer is dereferenced, the attacker can manipulate the freed memory to gain control of execution flow and achieve remote code execution on the ESXi host.
Learn more: CWE-416 — Use After Free
Impact Analysis
CVE-2020-3992 carries a CVSS 3.1 score of 9.8 (CRITICAL), the highest practical severity rating. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication, and needs no user interaction. Successful exploitation completely compromises the confidentiality, integrity, and availability of the affected VMware ESXi host, potentially granting the attacker control over all virtual machines and data hosted on the hypervisor. The EPSS score of 85.76% places this vulnerability in the 99.37th percentile, indicating very high exploitation probability. This vulnerability is known to be used in ransomware campaigns, making it an especially urgent threat for organizations running VMware ESXi, as attackers can encrypt virtual machine disk files and demand ransom payments.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2020-3992 in the wild through its KEV catalog, and this vulnerability is known to be used in ransomware campaigns targeting VMware ESXi environments. The EPSS score of 85.76% (99.37th percentile) indicates very high exploitation activity. Third-party advisories are available from the Zero Day Initiative (ZDI-20-1377) and ZDI-20-1385, indicating coordinated disclosure and detailed vulnerability analysis. The known ransomware usage demonstrates that weaponized exploits are actively deployed by threat actors targeting ESXi infrastructure. Federal agencies were required to remediate this vulnerability by 2022-05-03 per CISA’s binding operational directive.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Install the VMware security patches from VMSA-2020-0023 for ESXi 7.0 (before ESXi_7.0.1-0.0.16850804), ESXi 6.7 (before ESXi670-202010401-SG), and ESXi 6.5 (before ESXi650-202010401-SG).
- Verify that all VMware ESXi hosts (versions 6.5, 6.7, 7.0.0) and VMware Cloud Foundation deployments (versions 3.x before 3.10.1.2 and 4.x before 4.1.0.1) have been updated to patched versions.
- Block network access to port 427 (SLP) on ESXi hosts using firewall rules. Disable the SLP service entirely on ESXi hosts if Service Location Protocol functionality is not required for your environment.
- Monitor ESXi host logs for indicators of compromise, including unusual SLP service behavior, unexpected process execution, signs of ransomware activity such as VM file encryption, and unauthorized datastore access.
- Implement strict network segmentation to isolate ESXi management interfaces, ensuring that only authorized administrator workstations can reach port 427 and other management ports on ESXi hosts.
Technical Details
CVE-2020-3992 is a use-after-free vulnerability in the OpenSLP implementation within VMware ESXi. The flaw occurs in the OpenSLP service listening on port 427, where memory that has been freed is subsequently referenced through a dangling pointer. An attacker with network access to the management network can send specially crafted SLP requests that trigger this use-after-free condition. By carefully manipulating heap allocations to control the contents of the freed memory region, the attacker can redirect execution flow when the stale pointer is dereferenced, achieving remote code execution on the ESXi host. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms that the vulnerability is network-accessible, trivially exploitable, and requires neither authentication nor user interaction, resulting in complete compromise of the hypervisor.
Frequently Asked Questions
Is CVE-2020-3992 being actively exploited?
Yes. CVE-2020-3992 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation. This vulnerability is known to be used in ransomware campaigns targeting VMware ESXi environments. The EPSS score of 85.76% (99.37th percentile) indicates very high exploitation probability.
What products are affected by CVE-2020-3992?
CVE-2020-3992 affects VMware ESXi versions 6.5, 6.7, and 7.0.0 before their respective security patches. VMware Cloud Foundation versions 3.x before 3.10.1.2 and 4.x before 4.1.0.1 are also affected, as they include vulnerable ESXi versions.
How do I fix CVE-2020-3992?
Apply updates per vendor instructions from VMware security advisory VMSA-2020-0023. Update ESXi 7.0 to ESXi_7.0.1-0.0.16850804 or later, ESXi 6.7 to ESXi670-202010401-SG or later, and ESXi 6.5 to ESXi650-202010401-SG or later. As an immediate mitigation, block port 427 and disable the SLP service on ESXi hosts.
How severe is CVE-2020-3992?
CVE-2020-3992 has a CVSS 3.1 score of 9.8 (CRITICAL). This is a maximum-severity vulnerability with confirmed ransomware usage, very high exploitation probability (EPSS 85.76%), and the potential to compromise entire VMware ESXi hosts including all hosted virtual machines and datastores.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.