VMware Issues Security Advisory for Guest-to-Host Escape Vulnerability (CVE-2018-6981)
VMware issued an advisory about two uninitialized stack memory usage bugs and has released patches and updates for some versions of the affected software.
Contexte
On November 9, VMware published a security advisory to address a Guest-to-Host Escape vulnerability affecting VMware ESXi, Workstation and Fusion. The vulnerability was discovered and released by a security researcher at GeekPwn 2018, an annual security conference in Shanghai, China which took place in late October 2018. The researcher reported the vulnerability to VMware through GeekPwn.
Source: @ChaitinTech on Twitter.
Vulnerability details
According to VMware’s Security Advisory, Zhangyanyu of Chaitin Tech reported two uninitialized stack memory usage bugs (CVE-2018-6981 and CVE-2018-6982) in the vmxnet3 virtual network adapter used in VMware. VMware notes that the vulnerability does not affect non-vmxnet3 virtual network adapters.
Exploitation of CVE-2018-6981 can lead to a guest-to-host escape, allowing the guest to execute code on the host, while exploitation of CVE-2018-6982 can lead to information disclosure from host to guest. In a tweet that includes a video demonstration of the exploit, Chaitin Tech asserts that this is the first time that anyone has escaped VMware EXSi and obtained a root shell on the host.
Urgently required actions
VMware’s Security Advisory includes patch availability details for consumers and businesses. Tenable’s Security Response team strongly encourages patching VMware ESXi versions and upgrading VMware Workstation and VMware Fusion using the table below:
Source : VMware Security Advisory
Identification des systèmes affectés
Une liste de plug-ins Tenable permettant d'identifier cette vulnérabilité apparaîtra ici au fur et à mesure de leur publication.
En savoir plus
Apprenez-en plus sur Tenable, la première plateforme de Cyber Exposure qui vous permet de gérer votre surface d'attaque moderne de manière globale. Get a free 60-day trial of Tenable.io Vulnerability Management.
Satnam Narang
Senior Staff Research Engineer, Security Response
Satnam a rejoint Tenable en 2018. Il a plus de 15 ans d'expérience dans le domaine de la sécurité (M86 Security et Symantec). Il a participé au groupe de travail anti-hameçonnage, aidé à produire un guide sur les réseaux sociaux pour la National Cyber Security Alliance et dévoilé un gigantesque botnet d'envoi de spam sur Twitter. Il a également été le premier à signaler les spambots sur Tinder. Il a aussi été invité au journal télévisé du soir sur NBC, aux émissions Entertainment Tonight et Bloomberg West et au podcast Why Oh Why.
Centres d'intérêt : Satnam écrit de la poésie et compose de la musique hip-hop. Il aime la musique live, passer du temps avec ses trois nièces, le football et le basketball, les films et la musique de Bollywood, et Grogu (Baby Yoda).
Articles connexes
Oracle April 2026 Critical Patch Update Addresses 241 CVEs
Oracle addresses 241 CVEs in its second quarterly update of 2026 with 481 patches, including 34 critical updates.
Beating the Mythos clock: Using Tenable Hexa AI custom agents for automated patching
See how Tenable Hexa AI custom agents empower you to counter machine-speed threats by automating vulnerability remediation. Learn how the Model Context Protocol (MCP) automates execution of risk-driven patching workflows, shifting your strategy from reactive tracking to continuous exposure…
Crushing the Axios supply chain threat with Tenable Hexa AI: Use cases for agentic AI
See how you can use Tenable Hexa AI to determine in minutes if you're impacted by the Axios npm supply chain attack. Learn how easy it is to automate configuration of scans, identify impacted assets, prioritize remediation, and more using agentic AI from Tenable.
- Vulnerability Management
- Vulnerability Scanning