ESXi 5

Plugin 99129 bundles four VMSA-2017-0006 bugs — CVE-2017-4902 (SVGA heap overflow), CVE-2017-4903 (SVGA uninitialized stack), CVE-2017-4904 (uninitialized memory guest-to-host RCE) and CVE-2017-4905 (uninitialized memory info-disclosure). The exploitable primitives live in the virtual SVGA device that every guest VM talks to by default. A local attacker inside a guest VM can drive the SVGA device into a state where guest-controlled bytes are executed on the VMX/hostd process on the ESXi host, escaping the tenancy boundary. Affected build: ESXi 5.5 prior to build 5230635 (patch ESXi550-201703401-SG, released March 2017).

Vendor called this HIGH (CVSSv3 8.8) because they scored under Base metrics with an implicit assumption you're patched on a supported release. In 2026 that assumption is dead. ESXi 5.5 reached End of General Support on 2020-09-19; there will never be another patch, backport, or security fix for this platform. Any 5.5 host still running is not a patch target — it is a retirement target. A guest-to-host escape on an unsupported hypervisor is CRITICAL, not HIGH, because the compensating control isn't a KB article, it's a migration project.

Why this verdict

• Role multiplier — canonical hypervisor: the affected component *is* a hypervisor. Chain outcome is fleet-scale: every VM on the host, tenant data at rest, and pivot into vCenter credentials. Per noisgate rule, hypervisor-role bugs where the chain ends in host compromise carry a CRITICAL floor.
• Role multiplier — multi-tenant / DMZ workloads: if a 5.5 host runs any internet-facing or partner-facing guest, step 1 (guest compromise) is not a heavy lift — it's the daily job of your SOC. Every step after that is unstoppable on 5.5.
• EOL amplifier: vendor severity of HIGH assumes a patch exists and defenders will deploy it. On EOL 5.5, that assumption fails. There is no ESXi550-2026xxxxx patch train — the *only* remediation is migration off 5.5, which raises severity because the mean-time-to-close is now measured in project quarters, not KB installs.
• Friction acknowledged, floor unbroken: yes, the attacker needs guest RCE first, which narrows exposure to hosts running externally-reachable or multi-tenant workloads. That friction sets us at the low end of CRITICAL (9.1, not 9.8), but does NOT drop below the floor because the population that still runs 5.5 disproportionately runs it for legacy workloads on flat management networks.

Why not higher?

Not 9.8+ because the attacker needs code execution inside a guest VM first — this is not an unauthenticated network RCE like Log4Shell. EPSS is low and no commodity Metasploit module ships. If the guest is well-segmented and not internet-facing, the exposure window is narrower than a pre-auth wormable bug.

Why not lower?

Not HIGH because ESXi 5.5 is EOL — no patch exists for tomorrow's SVGA bug, and the compensating-control ceiling is 'retire the host,' not 'apply KB.' Not MEDIUM because guest-to-host escape on a hypervisor with vCenter pivot is a canonical fleet-compromise outcome; friction cannot pull below the hypervisor role floor without ≥1% installed-base evidence we do not have here.

1. Inventory every ESXi 5.5 host in the estate today — Query vCenter (Get-VMHost | Where-Object {$_.Version -eq '5.5.0'}) and any standalone hosts. You cannot mitigate what you have not enumerated. Complete inventory within 3 days per noisgate CRITICAL mitigation SLA.
2. Isolate 5.5 hosts on a dedicated management VLAN with no route to vCenter of newer clusters — Prevents step 5 (vCenter pivot) from cascading into modern hosts. Enforce with hardware firewall ACLs, not vSwitch port groups. Deploy within 3 days.
3. Evict multi-tenant or untrusted guests from 5.5 hosts — Move any DMZ, partner, developer, or internet-facing VM off 5.5 onto a supported hypervisor. This eliminates step 1 exposure. Complete within 3 days for internet-facing guests, 30 days for internal untrusted.
4. Schedule ESXi 5.5 retirement / migration to 7.0U3 or 8.0 — This is the actual remediation. Build the migration plan this week; execute within the 90-day noisgate CRITICAL remediation SLA. vMotion or cold-migrate guests to a supported cluster.
5. Enable hostd and vpxd log forwarding to SIEM for 5.5 hosts pending decommission — You will not detect the SVGA escape itself, but you will see VIB installs, unusual root logins, and vCenter auth from the box. Deploy immediately.

Run from an admin workstation with PowerCLI installed against your vCenter. Connect first with Connect-VIServer vcenter.example.com, then execute: .\Check-ESXi55-VMSA-2017-0006.ps1. Requires vCenter read-only role or better. Outputs VULNERABLE / PATCHED / UNKNOWN per host.

#requires -Modules VMware.PowerCLI
# Check-ESXi55-VMSA-2017-0006.ps1
# Detects ESXi 5.5 hosts below build 5230635 (VMSA-2017-0006)
# Exit 0 = all PATCHED; Exit 1 = at least one VULNERABLE; Exit 2 = UNKNOWN

$ErrorActionPreference = 'Stop'
$fixedBuild = 5230635
$exit = 0

try {
    $hosts = Get-VMHost | Select-Object Name, Version, Build
} catch {
    Write-Output "UNKNOWN - could not enumerate hosts: $_"
    exit 2
}

foreach ($h in $hosts) {
    if ($h.Version -eq '5.5.0') {
        if ([int]$h.Build -lt $fixedBuild) {
            Write-Output ("VULNERABLE {0} ESXi {1} build {2} (< {3})" -f $h.Name, $h.Version, $h.Build, $fixedBuild)
            $exit = 1
        } else {
            Write-Output ("PATCHED    {0} ESXi {1} build {2} (>= {3}) - NOTE: 5.5 is EOL, retire regardless" -f $h.Name, $h.Version, $h.Build, $fixedBuild)
        }
    } else {
        Write-Output ("NOT_APPLICABLE {0} ESXi {1} build {2}" -f $h.Name, $h.Version, $h.Build)
    }
}

exit $exit

Sources

1. Tenable plugin 99129
2. VMware VMSA-2017-0006 advisory
3. CVE-2017-4902 (NVD)
4. CVE-2017-4903 (NVD)
5. CVE-2017-4904 (NVD)
6. CVE-2017-4905 (NVD)
7. VMware ESXi 5.5 End of General Support notice
8. ZDI Pwn2Own 2017 VMware escape writeup