PT-2022-1601 · Vmware · Vmware Fusion+3

Wei · Published 2022-02-13 · Updated 2022-02-24 · CVE-2021-22040

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions VMware ESXi (affected versions not specified) VMware Workstation (affected versions not specified) VMware Fusion (affected versions not specified) VMware Cloud Foundation (affected versions not specified)

Description A use-after-free vulnerability exists in the XHCI USB controller of the affected software. This issue can be exploited by a malicious actor with local administrative privileges on a virtual machine to execute code as the virtual machine's VMX process running on the host.

Recommendations For VMware ESXi, update to a version that includes the fix for this issue. For VMware Workstation, update to a version that includes the fix for this issue. For VMware Fusion, update to a version that includes the fix for this issue. For VMware Cloud Foundation, update to a version that includes the fix for this issue. As a temporary workaround, consider disabling the XHCI USB controller until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2022-00820

CVE-2021-22040

Affected Products

Vmware Cloud Foundation

Vmware Esxi

Vmware Fusion

Vmware Workstation

References · 9

• https://vmware.com/security/advisories/VMSA-2022-0004.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-22040 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-00820 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-22040 · Security Note
• https://t.me/cvenotify/26870 · Telegram Post
• https://t.me/true_secator/2633 · Telegram Post
• https://t.me/sysadm_in_channel/3782 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2022021512 · Note
• https://t.me/cvenotify/27298 · Telegram Post