Multiple vulnerabilities in VMware Workstation and Fusion
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 3 |
| CVE-ID | CVE-2024-22252 CVE-2024-22253 CVE-2024-22255 |
| CWE-ID | CWE-416 CWE-200 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
VMware Fusion Client/Desktop applications / Virtualization software VMware Workstation Client/Desktop applications / Virtualization software |
| Vendor | VMware, Inc |
Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
1) Use-after-free
EUVDB-ID: #VU87130
Risk: High
CVSSv3.1: 7.3 [CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2024-22252
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a remote user to compromise vulnerable system.
The vulnerability exists due to a use-after-free error in the XHCI USB controller. A remote attacker with administrative access to the guest OS can trigger a use-after-free error and execute arbitrary code on the host OS.
On ESXi, the exploitation is contained within the VMX sandbox whereas, on Workstation and Fusion, this may lead to code execution on the machine where Workstation or Fusion is installed.
MitigationInstall update from vendor's website.
Vulnerable software versionsVMware Fusion: 13.0 - 13.5
VMware Workstation: 17.0 - 17.5
External linkshttp://www.vmware.com/security/advisories/VMSA-2024-0006.html
http://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24266
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the local network (LAN).
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to open a a specially crafted file.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Use-after-free
EUVDB-ID: #VU87131
Risk: High
CVSSv3.1: 7.3 [CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2024-22253
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a remote user to compromise vulnerable system.
The vulnerability exists due to a use-after-free error in the UHCI USB controller. A remote attacker with administrative access to the guest OS can trigger a use-after-free error and execute arbitrary code on the host OS.
On ESXi, the exploitation is contained within the VMX sandbox whereas, on Workstation and Fusion, this may lead to code execution on the machine where Workstation or Fusion is installed.
MitigationInstall update from vendor's website.
Vulnerable software versionsVMware Fusion: 13.0 - 13.5
VMware Workstation: 17.0 - 17.5
External linkshttp://www.vmware.com/security/advisories/VMSA-2024-0006.html
http://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24266
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the local network (LAN).
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to open a a specially crafted file.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Information disclosure
EUVDB-ID: #VU87133
Risk: Medium
CVSSv3.1: 5.9 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2024-22255
CWE-ID:
CWE-200 - Information exposure
Exploit availability: No
DescriptionThe vulnerability allows a remote user to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output in the UHCI USB controller. A remote user with administrative access to the guest OS can read memory from the vmx process.
MitigationInstall update from vendor's website.
Vulnerable software versionsVMware Fusion: 13.0 - 13.5
VMware Workstation: 17.0 - 17.5
External linkshttp://www.vmware.com/security/advisories/VMSA-2024-0006.html
http://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24266
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to open a a specially crafted file.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
