PT-2022-1605 · Vmware · Vmware Fusion+2
CVSS v3.1
7.8
High
| Vector | AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
VMware ESXi versions 6.5 through 7.0 before ESXi670-202111101-SG
VMware ESXi version 6.7 before ESXi670-202111101-SG
VMware Workstation version 16.2.0
VMware Fusion version 12.2.0
Description
The issue is related to a heap-overflow vulnerability in CD-ROM device emulation. A malicious actor with access to a virtual machine with CD-ROM device emulation may be able to exploit this vulnerability in conjunction with other issues to execute code on the hypervisor from a virtual machine. This vulnerability is associated with a buffer overflow in memory.
Recommendations
For VMware ESXi versions 6.5 through 7.0 before ESXi670-202111101-SG, update to a version that includes the ESXi670-202111101-SG patch or later.
For VMware ESXi version 6.7 before ESXi670-202111101-SG, update to a version that includes the ESXi670-202111101-SG patch or later.
For VMware Workstation version 16.2.0, consider disabling the CD-ROM device emulation until a patch is available.
For VMware Fusion version 12.2.0, consider disabling the CD-ROM device emulation until a patch is available.
Fix
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Vmware Esxi
Vmware Fusion
Vmware Workstation