Launching soon: The world's first vendor agnostic bug scrubLearn more & join waitlist
OPERATIONAL DEFECT DATABASE
...
...
CVE-2019-5518 and CVE-2019-5519 have been determined to affect: VMware vSphere ESXi 6.7, 6.5 & 6.0 (ESXi)VMware Workstation Pro / Player 15.x & 14.x (Workstation)VMware Fusion Pro / Fusion 11.x & 10.x (Fusion) These vulnerabilities and their impact on VMware products are documented in VMSA-2019-0005. Please review this advisory before continuing as there may be considerations outside the scope of this particular document.VMware has investigated CVE-2019-5518 and CVE-2019-5519 and determined that the possibility of exploitation can be removed by performing the steps detailed in the resolution section of this article. This workaround is meant to be a temporary solution only - permanent fixes are as detailed in VMSA-2019-0005.Warning: This workaround is applicable ONLY to: VMware vSphere ESXi 6.7, 6.5 & 6.0 (ESXi)VMware Workstation Pro / Player 15.x & 14.x (Workstation)VMware Fusion Pro / Fusion 11.x & 10.x (Fusion) Do not apply this workaround to other VMware products.VMware vSphere ESXi Functionality Impacts:The workaround is to remove any virtual USB 1.1 (UHCI) / 2.0 (EHCI) controllers that might be attached to the VM. Unless the VM has a virtual USB 3.0 (xHCI) controller, the VM will be left with no USB controllers at all. As a result, theuser will be unable to connect USB devices to the VM via USB passthrough. This includes both Host-Connected and Client-Connected USB passthrough: Host-Connected: This has been available since vSphere 4.1, and allows a USB device plugged directly into the ESXi/ESX host to be passed through to a virtual machine.Client-Connected: This feature became available with the release of vSphere 5.0, and allows a USB device plugged into a user’s workstation to be passed through to a virtual machine via the vSphere Client.
VMware vSphere ESXi Resolution Both vulnerabilities are in the virtual USB 1.1 (UHCI) controller. To work around the issue, the virtual USB 1.1 controller needs to be removed from the VM.Notes: The vSphere UI (vCenter Server, ESXi Embedded Host Client) only allows for the configuration of virtual USB 2.0 or virtual USB 3.0 controllers in VMs.When a virtual USB 2.0 controller is added to a VM in vSphere, BOTH a virtual USB 1.1 AND a virtual USB 2.0 controller are added to the VM by default.Removing the virtual USB 2.0 controller will also remove the virtual USB 1.1 controller from the VM. To implement the workaround for CVE-2019-5518 and CVE-2019-5519, perform the following steps:Through the vSphere User Interface (UI): Power-off the virtual machine.Right-click the virtual machine and click "Edit Settings".Remove all USB 2.0 controllers from the VM. This will also automatically remove all USB 1.1 controllers.Click "Save" to apply the new virtual machine configuration.Power-on the virtual machine. Verify from the guest that there is no USB 1.1 / USB 2.0 controller visible to the guest.Windows Open Windows Device Manager (Win+R and type devmgmt.msc).Expand the list of Universal Serial Bus controllers.Ensure there is no "USB Universal Host Controller" visible in the list.Ensure there is no "USB2 Enhanced Host Controller" visible in the list. Linux Open a terminal.Type "lspci | grep -i usb" .Ensure there is no USB1.1/USB2.0 controller in the lspci output. Mac Navigate to Apple menu > About this Mac.Click the System Report button.Go to Hardware > USB.Ensure there is no USB 1.1/USB 2.0 bus listed. To reverse the workaround, add a USB 2.0 controller to a virtual machine. This will automatically add a USB 1.1 controller.Through the vSphere User Interface (UI): Power-off the virtual machine.Right-click the virtual machine and click Edit Settings.Click on "Add Other Device".Click on "USB Controller".Chose USB 2.0 as the controller type.Click "Save" to apply the new virtual machine configuration. VMware Workstation and Fusion Resolution Both vulnerabilities are in the virtual USB 1.1 (UHCI) controller. To work around the issue the virtual USB 1.1 controller needs to be removed from the VM.Notes: The Workstation and Fusion UI allow for the configuration of virtual USB 1.1 or virtual USB 2.0 or virtual USB 3.0 controllers in VMs. When a virtual USB 2.0 controller is added to a VM in Workstation or Fusion, BOTH a virtual USB 1.1 AND a virtual USB 2.0 controller are added to the VM by default. Removing the virtual USB 2.0 controller will also remove the virtual USB 1.1 controller from the VM.When a virtual USB 3.0 controller is added to a VM in Workstation or Fusion, a virtual USB 1.1 AND a virtual USB 2.0 AND a virtual USB 3.0 controller are added to the VM by default. Removing the virtual USB 3.0 controller will also remove the virtual USB 1.1 controller AND the virtual USB 2.0 controller from the VM. Perform the following steps to remove all USB controllers, to implement the workaround for CVE-2019-5518 and CVE-2019-5519:Through the Workstation User Interface (UI): Power-off the virtual machine.Select “VM > Settings”.Click "Hardware".Select the USB Controller device.Click "Remove". Through the Fusion User Interface (UI): Power-off the virtual machine.Select “Window > Virtual Machine Library”.Select a virtual machine in the “Virtual Machine Library” window and click “Settings”.Under Removable Devices in the “Settings” window, click “USB & Bluetooth”.Under Advanced USB options, click “Remove USB Controller”.Click “Remove” in the confirmation dialog box. Verify from the guest OS that there is no USB 1.1/USB 2.0/USB 3.0 controller visible to the guest.Windows Open Windows Device Manager (Win+R and type devmgmt.msc).Expand the list of Universal Serial Bus controllers.Ensure there is no "USB Universal Host Controller" visible in the list.Ensure there is no "USB2 Enhanced Host Controller" visible in the list.Ensure there is no "USB3 eXtensible Host Controller" visible in the list. Linux Open a terminal.Type "lspci | grep -i usb". Ensure there is no USB1.1/USB2.0/USB 3.0 controller in the lspci output. Mac Navigate to Apple menu > About this Mac.Click the System Report button.Go to Hardware > USB.Ensure there is no USB1.1/USB2.0/USB 3.0 bus listed. To reverse the workaround, add a USB controller to a virtual machine:Through the Workstation User Interface (UI): Power-off the virtual machine.Select “VM > Settings”.On the "Hardware" tab, click “Add”.In the “New Hardware” wizard, select “USB Controller”.Click “Finish” to add the USB controller.Configure the USB connection settings. Through the Fusion User Interface (UI): Power-off the virtual machine.Select “Window > Virtual Machine Library”.Select a virtual machine in the “Virtual Machine Library” window and click “Settings”.Under Removable Devices in the “Settings” window, click “USB & Bluetooth”.Under Advanced USB options, use the drop-down menu to select how Fusion should respond when a USB device is plugged in to your Mac. For an up-to-date information on CVE-2019-5518 and CVE-2019-5519 as well as future security information please add your email address to the "Sign up for Security Advisories" window found in VMSA-2019-0005.
Remove a USB Controller from a Virtual Machine VMware vSphere ESXi 6.0VMware vSphere ESXi 6.5VMware vSphere ESXi 6.7 Workstation 15.xWorkstation 14.xFusion 11.xFusion 10.x Add a USB Controller to a Virtual Machine VMware vSphere ESXi vSphere 6.0VMware vSphere ESXi vSphere 6.5VMware vSphere ESXi vSphere 6.7Workstation 15.xWorkstation 14.xFusion 11.xFusion 10.x Note: The preceding link was correct as of May 16, 2019. If you find the link is broken, provide feedback and a VMware employee will update the link.