CVE-2020-3968: 
NixOS vulnerability analysis and mitigation

CVE-2020-3968 is an out-of-bounds write vulnerability discovered in the USB 3.0 controller (xHCI) component of VMware ESXi, Workstation, and Fusion products. The vulnerability was disclosed on June 22, 2020, and affects multiple versions of VMware products including ESXi (7.0, 6.7, 6.5), Workstation (15.x before 15.5.5), Fusion (11.x before 11.5.5), and VMware Cloud Foundation. VMware has evaluated this vulnerability to be in the Important severity range with a CVSSv3 base score of 8.1 (VMware Advisory).

The vulnerability exists within the xHCI component of VMware's virtualization products. When processing USB 3.0 controller operations, the system does not properly validate user-supplied data, which can result in an out-of-bounds write condition. The vulnerability has been assigned a CVSSv3 base score of 8.2 with the vector string AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, indicating local access requirements and high privileges needed for exploitation (ZDI Advisory).

The exploitation of this vulnerability could allow an attacker to either crash the virtual machine's vmx process, leading to a denial of service condition, or potentially execute code on the hypervisor from a virtual machine. The impact is particularly severe as it could lead to a complete compromise of the hypervisor security (VMware Advisory).

The vulnerability requires a malicious actor to have local administrative privileges on a virtual machine to exploit the issue. Additionally, certain conditions beyond the attacker's control must be present for exploitation to be possible. The vulnerability was discovered and reported by Reno Robert working with Trend Micro's Zero Day Initiative (VMware Advisory).

VMware has released patches to address this vulnerability in affected products. The fixed versions include ESXi_7.0.0-1.20.16321839 for ESXi 7.0, ESXi670-202004101-SG for ESXi 6.7, ESXi650-202005401-SG for ESXi 6.5, version 11.5.5 for Fusion, and version 15.5.5 for Workstation. As a workaround, administrators can remove the USB Controller from affected virtual machines (VMware Advisory).