This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] VMware fixes several vulnerabilities in ESXi, Workstation, Fusion and Cloud Foundation

VMware fixes several vulnerabilities in ESXi, Workstation, Fusion and Cloud Foundation. Products and their fixes: VMware ESXi - ESXi80U2sb-23305545, ESXi80U1d-23299997, ESXi70U3p-23307199 VMware Workstation - 17.5.1 VMware Fusion - 13.5.1 VMware Cloud Foundation - KB88287

VMware ESXi, Workstation, and Fusion - use-after-free (CVE-2024-22252)
CVSS 9.3 (Critical)

A local attacker with virtual machine administrator privileges can execute code as the VMX process of the virtual machine running on the host. On ESXi, the exploit is contained within the VMX sandbox, whereas on Workstation and Fusion it may lead to code execution on the computer where Workstation or Fusion is installed [1].

The vulnerability is present in products:

  • VMware ESXi; ==7.0; ==8.0; ==8.0
  • VMware Workstation; >=17.0, <17.5.1
  • VMware Fusion; >=13.0, <13.5.1

CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 5. 3. 2024.

VMware ESXi, Workstation, and Fusion - use-after-free (CVE-2024-22253)
CVSS 9.3 (Critical)

A local attacker with virtual machine administrator privileges can execute code as the VMX process of the virtual machine running on the host. On ESXi, the exploit is contained within the VMX sandbox, whereas on Workstation and Fusion it may lead to code execution on the computer where Workstation or Fusion is installed [1].

The vulnerability is present in products:

  • VMware ESXi; ==7.0; ==8.0; ==8.0
  • VMware Workstation; >=17.0, <17.5.1
  • VMware Fusion; >=13.0, <13.5.1

CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 5. 3. 2024.

VMware ESXi - Out-of-bounds write (CVE-2024-22254)
CVSS 7.9 (High)

A local attacker with privileges within the VMX process can trigger an out-of-bounds write, leading to a sandbox escape [1].

The vulnerability is present in product:

  • VMware ESXi; ==7.0; ==8.0; ==8.0

CVSS: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

More information:

The vulnerability was publicly disclosed 5. 3. 2024.

VMware ESXi, Workstation, and Fusion - information disclosure (CVE-2024-22255)
CVSS 7.1 (High)

A local attacker with administrative access to a virtual machine can cause a memory leak from the VMX process [1].

The vulnerability is present in products:

  • VMware ESXi; ==7.0; ==8.0; ==8.0
  • VMware Workstation; >=17.0, <17.5.1
  • VMware Fusion; >=13.0, <13.5.1

CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

More information:

The vulnerability was publicly disclosed 5. 3. 2024.

VMware Workstation, and Fusion - out-of-bounds read (CVE-2024-22251)
CVSS 5.9 (Medium)

An attacker with local administrator privileges on a virtual machine can trigger an out-of-bounds read, which may lead to information disclosure [2].

The vulnerability is present in products:

  • VMware Workstation; >=17.0, <17.5.1
  • VMware Fusion; >=13.0, <13.5.1

CVSS: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

More information:

The vulnerability was publicly disclosed 27. 2. 2024.

By CESNET, z.s.p.o. Michaela Jarošová on 11. 3. 2024.

CESNET, z.s.p.o. Logo