Saturday, November 9, 2024
HomeCyber AttackCritical VMware Vulnerabilities Let Attackers Execute Arbitrary Code

Critical VMware Vulnerabilities Let Attackers Execute Arbitrary Code

Published on

Malware protection

VMware Workstation, Workstation Pro, and Fusion have been subjected to several privately reported and fixed flaws. VMware has published a security advisory on the critical bugs discovered and their workarounds.

CVE(s):

  • CVE-2023-20869 – Stack-based buffer-overflow vulnerability in Bluetooth device-sharing functionality
  • CVE-2023-20870 – Information disclosure vulnerability in Bluetooth device-sharing functionality
  • CVE-2023-20871 – VMware Fusion Raw Disk local privilege escalation vulnerability
  • CVE-2023-20872 – Out-of-bounds read/write vulnerability

The severity of these CVEs varies from 7.1 to 9.3. However, VMware has released a patch for all the affected versions.

CVE-2023-20869 – Stack-based buffer-overflow vulnerability in Bluetooth device-sharing functionality

CVSS Score: 9.3

- Advertisement - SIEM as a Service

To exploit this, a threat actor must have local admin privileges on the virtual machine. Exploitation leads to the execution of code using VMware’s VMX process on the host machine.

Affected Products and Fixed Versions

CVE-2023-20870 – Information disclosure vulnerability in Bluetooth device-sharing functionality

CVSS Score: 7.1

To exploit this, a threat actor must have local admin privileges on the virtual machine. Exploitation leads to the reading of privileged information on VMware’s hypervisor memory used for isolating virtual machines from each other. This memory includes CPU utilization, OS on the virtual machine, memory utilization, and much more.

Affected Products and Fixed Versions

  • VMware Workstation Pro / Player (Workstation) – Fixed in 17.0.2
  • VMware Fusion – Fixed in 13.0.2

CVE-2023-20871 – VMware Fusion Raw Disk local privilege escalation vulnerability

CVSS Score: 7.3

To exploit this, a threat actor must have read/write access to the host machine. Exploitation leads to gaining root access to the host operating system.

Affected Products and Fixed Versions

  • VMware Fusion – Fixed in 13.0.2

CVE-2023-20872 – Out-of-bounds read/write vulnerability

CVSS Score: 7.1

To exploit this, a threat actor must have a virtual machine with a Physical CD/DVD drive attached and a SCSI controller configured with the host machine. Exploitation leads to the execution of code in VMware’s hypervisor memory from the virtual machine. The threat actor does not need local admin privilege for this vulnerability. 

Affected Products and Fixed Versions

  • VMware Workstation Pro / Player (Workstation) – Fixed in 17.0.1
  • VMware Fusion – Fixed in 13.0.1

For more information on these CVEs, please visit VMware’s security advisory.

Furthermore, two of these vulnerabilities (CVE-2023-20869, CVE-2023-20870) were initially discovered and reported by STAR Labs on the Pwn2Own 2023 held at Vancouver in March 2023. The reward provided for these zero days was $80,000.

Struggling to Apply The Security Patch in Your System? – 
Try All-in-One Patch Manager Plus

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

CISA Warns of Critical Palo Alto Networks Vulnerability Exploited in Attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warns organizations of a critical vulnerability...

Cisco Desk Phone Series Vulnerability Lets Remote Attacker Access Sensitive Information

A significant vulnerability (CVE-2024-20445) has been discovered in Cisco Desk Phone 9800 Series, IP...

Cisco Flaw Let Attackers Run Command as Root User

A critical vulnerability has been discovered in Cisco Unified Industrial Wireless Software, which affects...

Researchers Detailed Credential Abuse Cycle

The United States Department of Justice has unsealed an indictment against Anonymous Sudan, a...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

CISA Warns of Critical Palo Alto Networks Vulnerability Exploited in Attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warns organizations of a critical vulnerability...

Cisco Desk Phone Series Vulnerability Lets Remote Attacker Access Sensitive Information

A significant vulnerability (CVE-2024-20445) has been discovered in Cisco Desk Phone 9800 Series, IP...

Cisco Flaw Let Attackers Run Command as Root User

A critical vulnerability has been discovered in Cisco Unified Industrial Wireless Software, which affects...