Out-of-bounds write in VMware ESXi - CVE-2022-31705

Vulnerability details

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the USB 2.0 controller (EHCI). A local privileged user on the guest OS can trigger an out-of-bounds write and execute arbitrary code as the virtual machine's VMX process running on the host.

Affected software

How to mitigate CVE-2022-31705

Install updates from vendor's website.

Note, on ESXi the exploitation is contained within the VMX sandbox.

Links to Public Exploits and PoC-codes

• Exploit #8717 - cve-2022-31705 (CVE-2022-31705 (Geekpwn 2022 Vmware EHCI OOB) POC ) (January 9, 2023)

External References

• https://www.vmware.com/security/advisories/VMSA-2022-0033.html

Related Security Bulletins

• Privilege escalation in VMWare ESXi
• Privilege escalation in VMware Workstation
• Privilege escalation in VMware Fusion
• Multiple vulnerabilities in Dell PowerStore Family
• Multiple vulnerabilities in Dell PowerFlex Appliance
• Multiple vulnerabilities in Dell PowerFlex Rack