CVE:CVE-2009-0177
CNNVD:CNNVD-200901-229
VMWare是一款虚拟PC软件，允许在一台机器上同时运行两个或多个Windows、DOS、LINUX系统。
VMWare的hcmon.sys驱动没有过滤用户态通过METHOD_NEITHER发送的指针：
.text:00011606 loc_11606: .text:00011606 mov eax, [ebp+SystemBuffer]
.text:00011609 mov [ebp+SystemBuffer2], eax
.text:0001160C mov ecx, [ebp+SystemBuffer2]
.text:0001160F mov edx, [ecx+0Ch] <---- BUGCHECK
.text:00011612 cmp edx, [ebp+var_20]
.text:00011615 jnz short loc_11629
.text:00011617 cmp [ebp+NumberOfBytes], 70h
.text:0001161B jbshort loc_11629
.text:0001161D mov eax, [ebp+SystemBuffer2]
.text:00011620 cmp dword ptr [eax+8], 7FFBh
.text:00011627 jbe short loc_11638
如果本地用户向\\.\hcmon设备发送了0x8101232B IOCTL，就可以导致内核崩溃。
solution:Upgrade vmware ace to a higher version than 2.5.1,2.5.0,and avoid the version (,2.5.1],2.5.0; Upgrade vmware fusion to a higher version than 2.0.1,and avoid the version (,2.0.1]; Upgrade vmware server to a higher version than 2.0.0,and avoid the version 2.0.0; Upgrade vmware vmware_player to a higher version than 2.5.1,1.0.0,1.0.1,1.0.2,1.0.3,1.0.4,1.0.6,1.0.7,1.0.8,1.0.9,1.05,2.0,2.0.1,2.0.2,2.0.3,2.0.4,2.0.5,2.5,and avoid the version (,2.5.1],1.0.0,1.0.1,1.0.2,1.0.3,1.0.4,1.0.6,1.0.7,1.0.8,1.0.9,1.05,2.0,2.0.1,2.0.2,2.0.3,2.0.4,2.0.5,2.5; Upgrade vmware vmware_workstation to a higher version than 6.51,4.5.3,5.0,5.5.0,5.5.1,5.5.2,5.5.3,5.5.4,5.5.5,5.5.6,5.5.7,5.5.8,6.0,6.0.1,6.0.2,6.0.3,6.0.4,6.0.5,6.5,and avoid the version (,6.51],4.5.3,5.0,5.5.0,5.5.1,5.5.2,5.5.3,5.5.4,5.5.5,5.5.6,5.5.7,5.5.8,6.0,6.0.1,6.0.2,6.0.3,6.0.4,6.0.5,6.5