Jump to content

VMware reveals patches for a host of security flaws, so update now

Recommended Posts


VMware has patched a whole host of security vulnerabilities affecting a number of its key business products  - and given that some of the flaws are high in severity, and would allow malicious actors to execute code remotely, the company advises users to apply the patches immediately.

According to VMware’s security advisory, the company patched four vulnerabilities: CVE-2024-22252, CVE-2024-22253, CVE-2024-22254, and CVE-2024-22255. These flaws affect ESXi, Workstation, and Fusion products.

The first two are described as use-after-free flaws in the XHCI USB controller, affecting all three products. For Workstation and Fusion, they carry a severity score of 9.3, while for ESXi, it’s 8.4.

Workarounds available

"A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host," the company said. "On ESXi, the exploitation is contained within the VMX sandbox whereas, on Workstation and Fusion, this may lead to code execution on the machine where Workstation or Fusion is installed."

Other two flaws are described as an out-of-bounds write flaw in ESXi (severity score 7.9), and an information disclosure vulnerability in UHCI USB controller (severity score 7.9). These two could be used to escape the sandbox and leak memory from the vmx processes.

To make sure their endpoints are secure, users should bring the products to these versions:

ESXi 6.5 - 6.5U3v
ESXi 6.7 - 6.7U3u
ESXi 7.0 - ESXi70U3p-23307199
ESXi 8.0 - ESXi80U2sb-23305545 and ESXi80U1d-23299997
VMware Cloud Foundation (VCF) 3.x
Workstation 17.x - 17.5.1
Fusion 13.x (macOS) - 13.5.1

Those who are unable to apply the patch immediately should remove all USB controllers from their virtual machines, as a workaround measure.

"In addition, virtual/emulated USB devices, such as VMware virtual USB stick or dongle, will not be available for use by the virtual machine," the company said. "In contrast, the default keyboard/mouse as input devices are not affected as they are, by default, not connected through USB protocol but have a driver that does software device emulation in the guest OS.

Via TheHackerNews

More from TechRadar Pro

View the full article

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Create New...