CVE-2020-3957: 
NixOS vulnerability analysis and mitigation

VMware Fusion (11.x before 11.5.5), VMware Remote Console for Mac (11.x and prior), and VMware Horizon Client for Mac (5.x and prior) contain a local privilege escalation vulnerability due to a Time-of-check Time-of-use (TOCTOU) issue in the service opener. The vulnerability was disclosed on May 28, 2020, and VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.3 (VMware Advisory).

The vulnerability (CVE-2020-3957) is caused by a Time-of-check Time-of-use (TOCTOU) issue in the service opener component. The vulnerability affects multiple VMware products running on OS X systems. The CVSS v3.1 base score of 7.3 indicates a high severity level, with the vector string AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L (VMware Advisory).

Successful exploitation of this vulnerability allows attackers with normal user privileges to escalate their privileges to root on the system where Fusion, VMRC for Mac, or Horizon Client for Mac is installed (VMware Advisory).

The vulnerability requires local access to the affected system with normal user privileges to exploit. VMware acknowledged Rich Mirch of TeamARES from Critical Start Inc. and Jeffball of GRIMM for independently reporting this issue (VMware Advisory).

VMware has released patches to address this vulnerability. The fixed versions are: VMware Fusion 11.5.5, VMware Remote Console for Mac 11.2.0, and VMware Horizon Client for Mac 5.4.3. No workarounds are available for this vulnerability, making patch installation the only remediation option (VMware Advisory).