CVE-2020-3970: 
NixOS vulnerability analysis and mitigation

CVE-2020-3970 is an out-of-bounds read vulnerability discovered in the Shader functionality of VMware ESXi (versions 7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202004101-SG, and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.5), and Fusion (11.x before 11.5.5). The vulnerability was disclosed in June 2020 and received a CVSS v3.1 base score of 3.8 (Low severity) (NVD, VMware Advisory).

The vulnerability exists in the Shader functionality of VMware's virtualization products. It manifests as an out-of-bounds read condition that could be triggered when processing shader bytecode. VMware has evaluated this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 4.0. The vulnerability is tracked as CWE-125 (Out-of-bounds Read) (NVD, ZDI Advisory).

When exploited, this vulnerability allows an attacker to crash the virtual machine's vmx process, resulting in a partial denial of service condition. The impact is limited to availability and does not appear to allow for code execution or information disclosure (VMware Advisory).

VMware has released patches to address this vulnerability. Users should upgrade to ESXi_7.0.0-1.20.16321839 for ESXi 7.0, ESXi670-202004101-SG for ESXi 6.7, ESXi650-202005401-SG for ESXi 6.5, version 15.5.5 for Workstation, and version 11.5.5 for Fusion. For environments where immediate patching is not possible, it's worth noting that 3D graphics are not enabled by default on ESXi, though they are enabled by default on Workstation and Fusion (VMware Advisory).