Vulnerabilities in VMware Workstation and Fusion Products Disclosed

Multiple security vulnerabilities have been uncovered in VMware Workstation and Fusion products, posing significant risks to users’ data security. These flaws, if exploited, could grant threat actors access to sensitive information, cause denial-of-service (DoS) attacks, and even execute malicious code.

Vulnerability in VMware Details

The vulnerabilities affect Workstation versions 17.x and Fusion versions 13.x, and have been addressed in the latest releases: version 17.5.2 for Workstation and version 13.5.2 for Fusion, as announced by the virtualization services provider, Broadcom. Here’s a brief overview of each vulnerability:

  • CVE-2024-22267 (CVSS score: 9.3): This vulnerability involves a use-after-free issue in the Bluetooth device, allowing a malicious actor with local administrative privileges on a virtual machine to execute code within the VMX process running on the host.
  • CVE-2024-22268 (CVSS score: 7.1): A heap buffer-overflow vulnerability in the Shader functionality could be exploited by an attacker with non-administrative access to a virtual machine with 3D graphics enabled, potentially leading to a DoS scenario.
  • CVE-2024-22269 (CVSS score: 7.1): This flaw is an information disclosure vulnerability in the Bluetooth device, enabling a malicious actor with local administrative privileges on a virtual machine to access privileged information from the hypervisor memory.
  • CVE-2024-22270 (CVSS score: 7.1): Another information disclosure vulnerability, this time in the Host Guest File Sharing (HGFS) functionality, allows a malicious actor with local administrative privileges to read privileged information from the hypervisor memory.

Temporary Workarounds and Recommendations

As a temporary measure until the patches can be applied, users are advised to disable Bluetooth support and 3D acceleration feature on their virtual machines. However, there are no specific mitigations for CVE-2024-22270 other than updating to the latest versions.

Origin and Response Vulnerabilities in VMware

It’s noteworthy that CVE-2024-22267, CVE-2024-22269, and CVE-2024-22270 were first demonstrated by STAR Labs SG and Theori at the Pwn2Own hacking contest held in March. This advisory follows the release of patches by the company two months ago to address four security flaws affecting ESXi, Workstation, and Fusion, including two critical vulnerabilities (CVE-2024-22252 and CVE-2024-22253, with CVSS scores of 9.3 and 8.4 respectively) capable of leading to code execution.

Conclusion

In light of these revelations, it’s imperative for users of VMware Workstation and Fusion products to promptly update to the latest versions to safeguard their systems against potential exploitation. Additionally, implementing the recommended temporary workarounds can provide an added layer of protection until the patches can be applied. Stay vigilant and prioritize cybersecurity measures to mitigate the risks posed by these vulnerabilities.

Leave a Reply

Your email address will not be published. Required fields are marked *