PT-2022-2229 · Vmware · Vmware Esxi

Wei · Published 2022-02-15 · Updated 2022-02-24 · CVE-2021-22043

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VMware ESXi (affected versions not specified)

Description The issue is related to a TOCTOU (Time-of-check Time-of-use) vulnerability in the handling of temporary files. This can be exploited by a malicious actor with access to settingsd to escalate their privileges by writing arbitrary files. The vulnerability is also associated with synchronization errors when using a shared resource, which can allow an attacker to elevate their privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

BDU:2022-02313

CVE-2021-22043

Affected Products

Vmware Esxi

References · 10

• https://vmware.com/security/advisories/VMSA-2022-0004.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02313 · Security Note
• https://osv.dev/vulnerability/CVE-2021-22043 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22043 · Security Note
• https://t.me/cvenotify/27302 · Telegram Post
• https://t.me/true_secator/2633 · Telegram Post
• https://t.me/sysadm_in_channel/3782 · Telegram Post
• https://t.me/cvenotify/26873 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2022021512 · Note
• https://t.me/cvenotify/26874 · Telegram Post