Critical VMware Bugs Open ESXi, Fusion & Workstation to Attackers

VMware has issued a critical security update to tackle issues in its ESXi, Fusion and Workstation products, which include VMware Cloud Foundation variations. Exploitation could give attackers entry to workloads inside of organizations’ digital environments.

The bugs have a variety of 5.3 to 8.4 out of 10 on the CVSS vulnerability-severity scale, making them separately “important” or “moderate” issues. Nonetheless, the virtualization giant mentioned that they can be chained with each other for worse outcomes: “Combining these issues may well result in better severity, for this reason the severity of this [advisory] is at severity amount critical.”

VMware noted that patching VMware ESXi, Fusion and Workstation is the speediest system to resolve the issues, but companies could also eliminate USB controllers from their VMs as a workaround. On the other hand, “that could be infeasible at scale…and does not remove the potential danger like patching does,” according to the advisory, issued Tuesday.

The issues are as follows:

• CVE-2021-22040: Use-right after-free vulnerability in XHCI USB controller (CVSS 8.4)
• CVE-2021-22041: Double-fetch vulnerability in UHCI USB controller (CVSS 8.4)
• CVE-2021-22042: ESXi ‘settingsd’ unauthorized obtain vulnerability (CVSS 8.2)
• CVE-2021-22043: ‘ESXi settingsd’ TOCTOU vulnerability (CVSS 8.2)
• CVE-2021-22050: ESXi sluggish HTTP Article denial of assistance vulnerability (CVSS 5.3)

USB Controller Bugs

The first two important-rated issues (CVE-2021-22040, CVE-2021-22041) exist in the USB controllers for VMware ESXi, Fusion and Workstation. If exploited, a malicious actor with area administrative privileges on a digital device (VM) would be capable to execute code as the VM’s Digital Device Extension (VMX) procedure working on the host.

The VMX process runs in the VMkernel and is dependable for dealing with enter/output (I/O) to gadgets that are not critical to effectiveness, according to VMware’s documentation.

‘settingsd’ Security Flaws

The up coming two issues, also rated critical (CVE-2021-22042, CVE-2021-22043) affect the ‘settingsd’ command, which is responsible for options and host logs, among other things.

The first will involve the VMX acquiring unauthorized obtain to settingsd authorization tickets. That implies that a destructive actor with privileges within just the VMX procedure could accessibility the settingsd provider functioning as a substantial privileged consumer.

The second, a time-of-test time-of-use vulnerability, can be chained with the first. It exists in the way momentary information are taken care of, and it would permit an attacker with entry to settingsd to escalate privileges by producing arbitrary information, according to VMware.

Reasonable Flaw in ESXi

The last bug (CVE-2021-22050) is the lone “moderate” vulnerability in the team. It only impacts the ESXi system, and could enable adversaries to make a denial-of-company (DoS) ailment on the hosts by overpowering the “rhttpproxy” support with many requests.

A productive exploit involves that the destructive actors previously have network entry to ESXi, in accordance to the vendor.

This is the next big patch launch this yr affecting this unique trio of products and solutions. Full details of which patches really should be applied to remediate the dangers are offered in VMware’s advisory.

The enterprise claimed that so far, no in-the-wild attacks have been seen concentrating on the bugs, nevertheless that is possible to speedily adjust, if previous is prelude, so admins should patch rapidly.

Be a part of Threatpost on Wed. Feb 23 at 2 PM ET for a LIVE roundtable discussion, “The Key to Retaining Secrets,” sponsored by Keeper Security, will aim on how to identify and lock down your organization’s most sensitive facts. Zane Bond with Keeper Security will join Threatpost’s Becky Bracken to provide concrete actions to secure your organization’s critical details in the cloud, in transit and in storage. Sign up NOW and you should Tweet us your queries ahead of time @Threatpost so they can be included in the discussion.