VMware Patches Severe Security Flaws in Workstation and Fusion Products

Technology

May 14, 2024NewsroomBluetooth / Vulnerability

VMware

Multiple security flaws have been disclosed in VMware Workstation and Fusion products that could be exploited by threat actors to access sensitive information, trigger a denial-of-service (DoS) condition, and execute code under certain circumstances.

The four vulnerabilities impact Workstation versions 17.x and Fusion versions 13.x, with fixes available in version 17.5.2 and 13.5.2, respectively, the Broadcom-owned virtualization services provider said.

Cybersecurity

A brief description of each of the flaws is below –

  • CVE-2024-22267 (CVSS score: 9.3) – A use-after-free vulnerability in the Bluetooth device that could be exploited by a malicious actor with local administrative privileges on a virtual machine to execute code as the virtual machine’s VMX process running on the host
  • CVE-2024-22268 (CVSS score: 7.1) – A heap buffer-overflow vulnerability in the Shader functionality that could be exploited by a malicious actor with non-administrative access to a virtual machine with 3D graphics enabled to create a DoS condition
  • CVE-2024-22269 (CVSS score: 7.1) – An information disclosure vulnerability in the Bluetooth device that could be exploited by a malicious actor with local administrative privileges on a virtual machine to read privileged information contained in hypervisor memory from a virtual machine
  • CVE-2024-22270 (CVSS score: 7.1) – An information disclosure vulnerability in the Host Guest File Sharing (HGFS) functionality that could be exploited by a malicious actor with local administrative privileges on a virtual machine to read privileged information contained in hypervisor memory from a virtual machine

As temporary workarounds until the patches can be deployed, users are advised to turn off the Bluetooth support on the virtual machine and disable 3D acceleration feature. There are no mitigations that address CVE-2024-22270 other than updating to the latest version.

Cybersecurity

It’s worth noting that CVE-2024-22267, CVE-2024-22269, and CVE-2024-22270 were originally demonstrated by STAR Labs SG and Theori at the Pwn2Own hacking contest held in Vancouver earlier this March.

The advisory comes more than two months after the company released patches to address four security flaws impacting ESXi, Workstation, and Fusion, including two critical flaws (CVE-2024-22252 and CVE-2024-22253, CVSS scores: 9.3/8.4)that could lead to code execution.

Found this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.

Read original source here.

Products You May Like

Articles You May Like

Shein US IPO is dead, experts say
DJT share price down nearly 50% since Trump guilty verdict
Teen stabbed to death at pop-up carnival in Culver City – NBC Los Angeles
Taylor Swift, Hayley Williams Perform ‘Castles Crumbling’ in London
Apple Could Partner With Meta to Bring Meta AI to iPhone, iPad, and Mac Devices: Report