Loading

×Sorry to interrupt
Uncaught ReferenceError: addCTracking is not defined
throws at https://kb.vmware.com/resource/KM_TealiumTrackingJS?v=0.5:100:1

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

My Subscriptions

Loading

Knowledge Base

VMware vSphere ESXi, Workstation and Fusion workaround for CVE-2019-5518 and CVE-2019-5519 (67806)

Last Updated: 2/28/2024Categories: SecurityTotal Views: 17443Language:
English

6 like this article

Subscribe to get an email
newsletter with new updates

6 people found this helpful Please provide article feedback:

Purpose

CVE-2019-5518 and CVE-2019-5519 have been determined to affect:

VMware vSphere ESXi 6.7, 6.5 & 6.0 (ESXi)

VMware Workstation Pro / Player 15.x & 14.x (Workstation)

VMware Fusion Pro / Fusion 11.x & 10.x (Fusion)

These vulnerabilities and their impact on VMware products are documented in VMSA-2019-0005. Please review this advisory before continuing as there may be considerations outside the scope of this particular document.

VMware has investigated CVE-2019-5518 and CVE-2019-5519 and determined that the possibility of exploitation can be removed by performing the steps detailed in the resolution section of this article. This workaround is meant to be a temporary solution only - permanent fixes are as detailed in VMSA-2019-0005.

Warning: This workaround is applicable ONLY to:

VMware vSphere ESXi 6.7, 6.5 & 6.0 (ESXi)

VMware Workstation Pro / Player 15.x & 14.x (Workstation)

VMware Fusion Pro / Fusion 11.x & 10.x (Fusion)

Do not apply this workaround to other VMware products.

VMware vSphere ESXi Functionality Impacts:

The workaround is to remove any virtual USB 1.1 (UHCI) / 2.0 (EHCI) controllers that might be attached to the VM. Unless the VM has a virtual USB 3.0 (xHCI) controller, the VM will be left with no USB controllers at all. As a result, the
user will be unable to connect USB devices to the VM via USB passthrough. This includes both Host-Connected and Client-Connected USB passthrough:

Host-Connected: This has been available since vSphere 4.1, and allows a USB device plugged directly into the ESXi/ESX host to be passed through to a virtual machine.

Client-Connected: This feature became available with the release of vSphere 5.0, and allows a USB device plugged into a user’s workstation to be passed through to a virtual machine via the vSphere Client.

Resolution

VMware vSphere ESXi Resolution

Both vulnerabilities are in the virtual USB 1.1 (UHCI) controller. To work around the issue, the virtual USB 1.1 controller needs to be removed from the VM.

Notes:

The vSphere UI (vCenter Server, ESXi Embedded Host Client) only allows for the configuration of virtual USB 2.0 or virtual USB 3.0 controllers in VMs.

When a virtual USB 2.0 controller is added to a VM in vSphere, BOTH a virtual USB 1.1 AND a virtual USB 2.0 controller are added to the VM by default.

Removing the virtual USB 2.0 controller will also remove the virtual USB 1.1 controller from the VM.

To implement the workaround for CVE-2019-5518 and CVE-2019-5519, perform the following steps:

Through the vSphere User Interface (UI):

Power-off the virtual machine.

Right-click the virtual machine and click "Edit Settings".

Remove all USB 2.0 controllers from the VM. This will also automatically remove all USB 1.1 controllers.

Click "Save" to apply the new virtual machine configuration.

Power-on the virtual machine.

Verify from the guest that there is no USB 1.1 / USB 2.0 controller visible to the guest.

Windows

Open Windows Device Manager (Win+R and type devmgmt.msc).

Expand the list of Universal Serial Bus controllers.

Ensure there is no "USB Universal Host Controller" visible in the list.

Ensure there is no "USB2 Enhanced Host Controller" visible in the list.

Linux

Open a terminal.

Type "lspci | grep -i usb" .

Ensure there is no USB1.1/USB2.0 controller in the lspci output.

Mac

Navigate to Apple menu > About this Mac.

Click the System Report button.

Go to Hardware > USB.

Ensure there is no USB 1.1/USB 2.0 bus listed.

To reverse the workaround, add a USB 2.0 controller to a virtual machine. This will automatically add a USB 1.1 controller.

Through the vSphere User Interface (UI):

Power-off the virtual machine.

Right-click the virtual machine and click Edit Settings.

Click on "Add Other Device".

Click on "USB Controller".

Chose USB 2.0 as the controller type.

Click "Save" to apply the new virtual machine configuration.

VMware Workstation and Fusion Resolution

Both vulnerabilities are in the virtual USB 1.1 (UHCI) controller. To work around the issue the virtual USB 1.1 controller needs to be removed from the VM.

Notes:

The Workstation and Fusion UI allow for the configuration of virtual USB 1.1 or virtual USB 2.0 or virtual USB 3.0 controllers in VMs.

When a virtual USB 2.0 controller is added to a VM in Workstation or Fusion, BOTH a virtual USB 1.1 AND a virtual USB 2.0 controller are added to the VM by default. Removing the virtual USB 2.0 controller will also remove the virtual USB 1.1 controller from the VM.

When a virtual USB 3.0 controller is added to a VM in Workstation or Fusion, a virtual USB 1.1 AND a virtual USB 2.0 AND a virtual USB 3.0 controller are added to the VM by default. Removing the virtual USB 3.0 controller will also remove the virtual USB 1.1 controller AND the virtual USB 2.0 controller from the VM.

Perform the following steps to remove all USB controllers, to implement the workaround for CVE-2019-5518 and CVE-2019-5519:

Through the Workstation User Interface (UI):

Power-off the virtual machine.

Select “VM > Settings”.

Click "Hardware".

Select the USB Controller device.

Click "Remove".

Through the Fusion User Interface (UI):

Power-off the virtual machine.

Select “Window > Virtual Machine Library”.

Select a virtual machine in the “Virtual Machine Library” window and click “Settings”.

Under Removable Devices in the “Settings” window, click “USB & Bluetooth”.

Under Advanced USB options, click “Remove USB Controller”.

Click “Remove” in the confirmation dialog box.

Verify from the guest OS that there is no USB 1.1/USB 2.0/USB 3.0 controller visible to the guest.

Windows

Open Windows Device Manager (Win+R and type devmgmt.msc).

Expand the list of Universal Serial Bus controllers.

Ensure there is no "USB Universal Host Controller" visible in the list.

Ensure there is no "USB2 Enhanced Host Controller" visible in the list.

Ensure there is no "USB3 eXtensible Host Controller" visible in the list.

Linux

Open a terminal.

Type "lspci | grep -i usb".

Ensure there is no USB1.1/USB2.0/USB 3.0 controller in the lspci output.

Mac

Navigate to Apple menu > About this Mac.

Click the System Report button.

Go to Hardware > USB.

Ensure there is no USB1.1/USB2.0/USB 3.0 bus listed.

To reverse the workaround, add a USB controller to a virtual machine:

Through the Workstation User Interface (UI):

Power-off the virtual machine.

Select “VM > Settings”.

On the "Hardware" tab, click “Add”.

In the “New Hardware” wizard, select “USB Controller”.

Click “Finish” to add the USB controller.

Configure the USB connection settings.

Through the Fusion User Interface (UI):

Power-off the virtual machine.

Select “Window > Virtual Machine Library”.

Select a virtual machine in the “Virtual Machine Library” window and click “Settings”.

Under Removable Devices in the “Settings” window, click “USB & Bluetooth”.

Under Advanced USB options, use the drop-down menu to select how Fusion should respond when a USB device is plugged in to your Mac.

For an up-to-date information on CVE-2019-5518 and CVE-2019-5519 as well as future security information please add your email address to the "Sign up for Security Advisories" window found in VMSA-2019-0005.

Related Information

Remove a USB Controller from a Virtual Machine

VMware vSphere ESXi 6.0

VMware vSphere ESXi 6.5

VMware vSphere ESXi 6.7

Workstation 15.x

Workstation 14.x

Fusion 11.x

Fusion 10.x

Add a USB Controller to a Virtual Machine

VMware vSphere ESXi vSphere 6.0

VMware vSphere ESXi vSphere 6.5

VMware vSphere ESXi vSphere 6.7

Workstation 15.x

Workstation 14.x

Fusion 11.x

Fusion 10.x

Note: The preceding link was correct as of May 16, 2019. If you find the link is broken, provide feedback and a VMware employee will update the link.

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
English

Attachments

Additional Resources

KB
•
vCenter Server Appliance REST-API 呼び出しが失敗し、ユーザーを承認できない (67483)

Result 1 of 1

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

VMware Workstation Pro

VMware vSphere ESXi

VMware Fusion Pro

VMware Fusion

Related Versions:

VMware Workstation Pro 15.x (Windows)

VMware Workstation Pro 15.x (Linux)

VMware Workstation Pro 14.x (for Windows)

VMware Workstation Pro 14.x (for Linux)

VMware vSphere ESXi 6.7

VMware vSphere ESXi 6.5

VMware vSphere ESXi 6.0

VMware Fusion Pro 11.x

VMware Fusion Pro 10.x

view all

Take Our Survey

Support Assistant