title: Information disclosure vulnerability in bluetooth device-sharing functionality
description: VMware Workstation( 17.x prior to 17.5) and Fusion(13.x prior to 13.5) contain an out-of-bounds
read vulnerability that exists in the functionality for sharing host
Bluetooth devices with the virtual machine. A malicious actor with local administrative privileges on a virtual
machine may be able to read privileged information contained in
hypervisor memory from a virtual machine.
affected:
{
defaultStatus: unaffected
platforms: [Windows, MacOS, Linux, iOS, Android, x86, ARM, 64 bit, 32 bit]
product: Workstation
vendor: VMware
versions:
lessThan: 17.5, status: affected, version: 17.x, versionType: 17.5
}
{
defaultStatus: unaffected
platforms: MacOS
product: Fusion
vendor: VMware
versions:
lessThan: 13.5, status: affected, version: 13.x, versionType: 13.5
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL