Hello everyone, this is Dina from VxRail gsc support team
in this video we are going to cover the workaround instructions for the USB
Controller Bugs CVE040 and CVE041 and also the recommendations to mitigate the issue.
First let's have a brief description about these vulnerabilities also called the USB controller box
VMware has published recently vms a004 that addresses security vulnerabilities found
and resolved in the VMware ESXI VMware Workstation, Fusion and VMware cloud
cloud foundation products briefly patching the VMware ESXI workstation and fusion are the fastest
methods to resolve these issues there is also a workaround to remove the USB controllers from the
virtual machines which we are going to discuss in this video these bugs specifically CVE040 and 041
are found in the USB controllers for the VMware ESXI Fusion and Workstation. Exploitation could
give attackers access to workloads inside the organization's virtual environments.
Taking advantage of this USB bug anyone with local administrative privileges on a virtual machine
would be able to execute code as the VM's virtual machine extension the VMX process running on the
host. The VMX process mainly runs in the VM Kernel and it is also responsible for handling
input output to devices that are not critical to performance and it's also responsible for
communicating with user interfaces snapshot managers and remote console. Moving forward
to the workaround to address this issue the workaround for both CVEs is to remove the USB
controllers from the virtual machine and as a result USB passthrough functionality will be
unavailable. Taking into consideration while the ESXI host supports hot removal of the
USB controller the guest operating system of the virtual machine must also support the hot removal
functionality. If the guest operating system does not support hot removal of a USB controller then
the VM will need to be powered off to make sure that the guest operating system of the virtual
machine supports the hot removal functionality you can refer to the vendor's documentation
so let's start applying this workaround on our environment
first we are going to log into the vSphere client ui then navigate to the data centre
click on VMs tab and then on the virtual machines which we are already on then we are going to
navigate to the virtual machine on which you want to remove the USB from. Right click on the virtual
machine then edit settings also ensure that the USB controller is nothing used prior to removing
it from the virtual machine and if required power up the virtual machine in this case there is no
requirement to power of the gas os okay so we are going to navigate to the USB port and then
remove the USB controller then click on ok to apply the new virtual machine configuration
okay you will find that the status of the task has completed
that's all for this workaround that's all for today thanks for watching have a great day
you