CVE-2020-3950

What Are These VMware macOS Products?

VMware Fusion, Remote Console (VMRC), and Horizon Client are VMware's macOS desktop virtualization and remote-access tools, used to run virtual machines or connect to remote virtual desktops directly from a Mac. To manage networking and hardware access for virtual machines, these applications ship helper binaries that run with elevated (setuid root) privileges — a common and necessary pattern for desktop virtualization software, but one that requires careful privilege handling to avoid becoming an escalation path.

Overview

CVE-2020-3950 is a privilege-escalation vulnerability (CWE-269, improper privilege management) in VMware Fusion, VMRC for Mac, and Horizon Client for Mac. Improper handling of a setuid binary allows a local, low-privileged attacker to escalate to root privileges (CVSS 3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 High).

Technical Details

The affected products include a setuid-root helper binary intended to perform specific privileged operations on behalf of the unprivileged application. Improper validation or handling within that binary allows a local attacker to manipulate its execution to run arbitrary code with root privileges, rather than being restricted to the narrow privileged operation the binary was designed to perform.

Discovery

Reported to VMware through its standard security disclosure process and addressed in VMware Security Advisory VMSA-2020-0004.

Exploitation Context

CISA added this CVE to KEV in November 2021 based on confirmed exploitation. Local privilege-escalation bugs in desktop virtualization software are attractive to attackers who have already gained initial low-privileged access to a Mac (via phishing, a malicious download, or another vector) and are looking to escalate to full root control of the host.

Remediation

1. Apply VMware's fixed release for Fusion, VMRC, or Horizon Client per VMSA-2020-0004 immediately.
2. Restrict local administrative rights for standard users where feasible, reducing the population of accounts that could exploit a local privilege-escalation bug.
3. Deploy endpoint detection capable of identifying anomalous setuid binary invocation or privilege escalation attempts on managed Mac fleets.
4. Treat any Mac running an unpatched, vulnerable version of these VMware products as carrying elevated local-compromise risk, particularly on systems used by less security-conscious end users.