VMware patches critical guest-to-host vulnerabilities

In an advisory this week, VMware alerted users to guest-to-host vulnerabilities in the XHCI and UHCI USB controllers in its ESXi hypervisor, plus an important flaw fixed in NSX Data Center for vSphere. In all, five vulnerabilities were discovered in VMware's ESXi, Workstation, Cloud Foundation (ESXi), and Fusion during the …

[Nate Amsden]

don't freak out too much

I just checked my group's VMs on ESXi 6.5, just over 700 VMs, 98% linux, only one of them has a USB controller(a special purpose windows system), should be easy enough to remove.

To check, I used the tool govc, parsed the VM listing, and then used the device.info option to list all devices attached to each VM. I know powershell is popular with vmware folks, as a linux person I have never really used Powershell myself(yes I know it's available for linux).

https://github.com/vmware/govmomi/blob/master/govc/USAGE.md

[-v(o.o)v-]

Really Reg, really?!

You couldn't say WHICH versions are vulnerable? 7.0? 6.5?

[Mobster]

i wonder if VMware is looking at Rust to help alleviate such coding introduced security issues.