CVE-2016-5328 describes a local information disclosure vulnerability in VMware Tools versions 9.x and 10.x prior to 10.1.0 on macOS, specifically when System Integrity Protection (SIP) is enabled. This flaw allows a local attacker to determine kernel memory addresses, thereby bypassing the kernel Address Space Layout Randomization (kASLR) protection mechanism. Rated Medium (CVSS 5.5), the vulnerability has low attack complexity and requires local access, with the primary impact being a high confidentiality risk. There is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit or ExploitDB, though it has received some community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 10.0.8CPE matchmatch criteria | cpe:2.3:a:vmware:tools:*:*:*:*:*:*:*:* | ||
10.0.0CPE matchmatch criteria | cpe:2.3:a:vmware:tools:10.0.0:*:*:*:*:*:*:* | ||
10.0.5CPE matchmatch criteria | cpe:2.3:a:vmware:tools:10.0.5:*:*:*:*:*:*:* | ||
10.0.6CPE matchmatch criteria | cpe:2.3:a:vmware:tools:10.0.6:*:*:*:*:*:*:* | ||
9.0.0CPE matchmatch criteria | cpe:2.3:a:vmware:tools:9.0.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.