VMware urgent updates addressed Critical ESXi Sandbox Escape bugs

Pierluigi Paganini March 05, 2024

VMware released urgent patches to address critical ESXi sandbox escape vulnerabilities in the ESXi, Workstation, Fusion and Cloud Foundation products

Virtualization giant VMware released urgent updates to fix critical ESXi sandbox escape vulnerabilities in the ESXi, Workstation, Fusion, and Cloud Foundation products.

The most severe vulnerabilities can be exploited by an attacker with local admin privileges on a virtual machine to execute code as the virtual machine’s VMX process running on the host.

The most severe flaws are the Use-after-free vulnerability in XHCI USB controller flaw CVE-2024-22252 and the Use-after-free vulnerability in UHCI USB controller CVE-2024-22253, both received a CVSS score of 9.3.

Below are the descriptions of the two vulnerabilities:

CVE-2024-22252 – “VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB controller.” reads the advisory. “A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine’s VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox whereas, on Workstation and Fusion, this may lead to code execution on the machine where Workstation or Fusion is installed.”

CVE-2024-22253 – “VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the UHCI USB controller.” reads the advisory. “A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine’s VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox whereas, on Workstation and Fusion, this may lead to code execution on the machine where Workstation or Fusion is installed.”

The company also addressed the following two vulnerabilities:

• ESXi Out-of-bounds write vulnerability (CVE-2024-22254) (CVSS Score 7.9)
• Information disclosure vulnerability in UHCI USB controller (CVE-2024-22255) (CVSS Score 7.1)

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Sandbox Escape)