PT-2022-5817 · Vmware · Vmware Esxi

Reno Robert · Published 2022-12-08 · Updated 2024-10-09 · CVE-2022-31696

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VMware ESXi (affected versions not specified)

Description The issue is related to a memory corruption vulnerability in the way VMware ESXi handles a network socket. A malicious actor with local access to ESXi may exploit this issue to corrupt memory, leading to an escape of the ESXi sandbox. This could potentially allow an attacker to execute arbitrary code with elevated privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Buffer Overflow

Weakness Enumeration

CWE-787

CWE-119

Related Identifiers

BDU:2022-07223

CVE-2022-31696

ZDI-22-1686

Affected Products

Vmware Esxi

References · 12

• https://vmware.com/security/advisories/VMSA-2022-0030.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31696 · Security Note
• https://bdu.fstec.ru/vul/2022-07223 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-1686 · Security Note
• https://osv.dev/vulnerability/CVE-2022-31696 · Vendor Advisory
• https://t.me/cybersecuritytechnologies/8546 · Telegram Post
• https://t.me/pentestingnews/37163 · Telegram Post
• https://t.me/pentestingnews/37105 · Telegram Post
• https://t.me/pentestingnews/31031 · Telegram Post
• https://t.me/cibsecurity/54421 · Telegram Post
• https://t.me/ckure/12559 · Telegram Post
• https://t.me/cvenotify/97601 · Telegram Post