VMware has addressed four bugs (CVE-2024-22252, CVE-2024-22253, CVE-2024-22254, CVE-2024-22255) in ESXi, Workstation, Fusion, and Cloud Foundation, some of which could allow attackers to escape the sandbox and execute code on the host.
See also: VMware: Critical Identity Bypass in VCD Appliance
VMware ESXi is a bare-metal subtype, VMware Workstation and Fusion are desktop subtypes, while VMware Cloud Foundation is a hybrid cloud.
CVE-2024-22252 and CVE-2024-22253 affect VMware ESXi, Workstation, and Fusion and are critical use-after-free vulnerabilities in the USB XHCI and UHCI controllers , respectively.
“A malicious user with local administrator on a virtual machine could exploit this issue to execute code as the virtual machine's VMX process running on the host computer. On ESXi, the exploit is limited to the VMX sandbox, while on Workstation and Fusion, this could lead to code execution on the machine where Workstation or Fusion is installed,” security advisory for the two bugs states.
CVE-2024-22254 is an out-of-bounds write vulnerability affecting VMware ESXi that could allow a malicious actor with VMX process privileges to escape the sandbox.
CVE-2024-22255 is an information leakage vulnerability in the UHCI USB controller affecting VMware ESXi, Workstation, and Fusion. A malicious user with administrative access to a virtual machine could exploit this to leak memory from the vmx process.
See also: VMware: Public exploitation of RCE flaw in vRealize
The VMware bugs were discovered and exploited by various teams participating in the 2023 Tianfu Cup Pwn Contest and have been confidentially reported to VMware for remediation.
Updates have been provided that fix vulnerabilities in:
- ESXi v7.0
- ESXi v8.0
- Workstation v17.x
- Fusion v13.x (macOS)
- Cloud Foundation (VCF) v5.x/4.x
Due to the severity of the vulnerabilities, the company is also providing a patch for the versions that have reached end-of-life: ESXi 6.7 (6.7U3u), 6.5 (6.5U3v), and VCF3.x.
See also: Broadcom: To lay off 1,300 VMware employees
What are the consequences of errors?
Errors, such as in the case of VMware, can lead to a loss of trust from customers or partners, as information may be exposed to risk. They can also lead to financial losses, either through lost business opportunities or through the costs of remediation. Errors can lead to legal consequences if the company fails to comply with data protection regulations. In addition, the company may face damage to its corporate reputation, which may be difficult to repair. Finally, vulnerabilities can create internal problems, such as loss of productivity or increased insecurity in the workplace.
Source: helpnetsecurity
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
