VMware response to CVE-2018-8897
search cancel

VMware response to CVE-2018-8897


Article ID: 328941


Updated On:


VMware vCenter Server


The VMware Security Engineering, Communications, and Response group (vSECR) has investigated the impact CVE-2018-8897 may have on VMware products.


Evaluation Summary:
  • CVE-2018-8897 has been classified as a potential local privilege escalation in the Important severity range. Please review our VMware Security Response Policies for information on severity classifications.
  • CVE-2018-8897 has the potential of affecting VMware Virtual Appliances by way of the linux-based operating system that they ship on top of.
  • Products that ship as an installable windows or linux binary are not directly affected, but patches may be required from the respective operating system vendor that these products are installed on.
  • VMware hypervisors are not affected by this issue.

Unaffected Products

vSECR has completed evaluation of the following products and determined that under supported configurations they are not affected as there is no available path to execute arbitrary code without administrative privileges.

Note: Automated vulnerability scanners may report that these products are vulnerable to CVE-2018-8897 even though the issue is not exploitable. These products will still be updating their respective kernels in scheduled maintenance releases as a precautionary measure.
VMware App Defense ApplianceAnyUnaffectedN/A
VMware ESXiAnyUnaffectedN/A
VMware Horizon DaaS PlatformAnyUnaffectedN/A
VMware Horizon MirageAnyUnaffectedN/A
VMware HCXAnyUnaffectedN/A
VMware Integrated OpenstackAnyUnaffectedN/A
VMware IoT PulseAnyUnaffectedN/A
VMware MirageAnyUnaffectedN/A
VMware NSX for vSphereAnyUnaffectedN/A
VMware NSX-TAnyUnaffectedN/A
VMware Skyline ApplianceAnyUnaffectedN/A
VMware Unified Access GatewayAnyUnaffectedN/A
VMware vCenter Server5.5UnaffectedN/A
VMware vCloud Availability for vCloud DirectorAnyUnaffectedN/A
VMware vCloud Director ExtenderAnyUnaffectedN/A
VMware vRealize Business for CloudAnyUnaffectedN/A
VMware vRealize Log InsightAnyUnaffectedN/A
VMware vRealize Network InsightAnyUnaffectedN/A
VMware vRealize OperationsAnyUnaffectedN/A
VMware vRealize OrchestratorAnyUnaffectedN/A
VMware vSphere ReplicationAnyUnaffectedN/A
VMware WorkbenchAnyUnaffectedN/A

Potentially Affected Products

vSECR has evaluated the following products and determined that they may be affected by CVE-2018-8897. Workarounds have been investigated and are noted by the product entry if available. Remediation will be made available in upcoming releases, please check the product release notes for more information.
VMware vCloud Usage MeterAnyPotentially AffectedKB 52467
VMware Identity ManagerAnyPotentially AffectedKB 52284
VMware vCenter Server6.7Potentially AffectedKB 52312
VMware vCenter Server6.5Potentially AffectedKB 52312
VMware vCenter Server6.0Potentially AffectedKB 52312
VMware Data ProtectionAnyPotentially AffectedNone
VMware vSphere Integrated ContainersAnyPotentially AffectedNone
VMware vRealize AutomationAnyPotentially AffectedKB 52377 and KB 52497

Please sign up at our Security-Announce mailing list to receive new and updated VMware Security Advisories and click Subscribe to Article in the Actions box to be alerted when new information is added to this document. If a specific version number is not listed, then that entry refers to all supported versions of the appliance.