Earlier this week, VMware announced the correction of multiple critical vulnerabilities in products such as VMware ESXi, Workstation and Fusion, most of them reported during last year’s Tianfu Cup ethical hacking summit in China.

During the event he highlighted the work of the Kunlun Lab hacking team, which won rewards of more than $650,000 USD for their work demonstrating the exploitation of some of these flaws.

Below is a brief description of the failures addressed according to a company report:

  • CVE-2021-22040: A use-after-free error in the ESXi, Workstation, and Fusion XHCI USB driver whose exploitation would allow local threat actors with administrator privileges to execute code as the VMX process of the virtual machine running on the host
  • CVE-2021-22041: A bug in the ESXi, Workstation, and Fusion USB UHCI driver would allow local attackers with administrator privileges to execute code as the VMX process of a virtual machine running on the host
  • CVE-2021-22042: Unauthorized access to settingsd in ESXi would allow malicious hackers within the VMX process to escalate their privileges on the affected system
  • CVE-2021-22043: A settingsd TOCTOU error in ESXi that exists due to the way temporary files are handled would allow threat actors to escalate their privileges on the affected system

The firm has also announced some alternative solutions for administrators who cannot update their implementations at the moment, in addition to recommending that clients apply the measures they consider necessary as soon as possible since the successful exploitation of these failures could result in catastrophic scenarios.

Finally, VMware mentioned that these failures were notified to the Chinese government, in compliance with a recently enacted law that states that Chinese researchers who find zero-day vulnerabilities must notify government agencies and manufacturers of the affected technology directly. Researchers will not be able to sell this information to third parties outside of China unrelated to the manufacturer/developer.

To learn more about information security risks, malware variants, vulnerabilities and information technologies, feel free to access the International Institute of Cyber Security (IICS) websites.

The post Chinese researchers find multiple vulnerabilities in VMware ESXi, Workstation and Fusion; update ASAP appeared first on Information Security Newspaper | Hacking News.


You May Also Like

Critical password reset vulnerability in Fortinet FortiPortal. Update immediately

Cybersecurity specialists report the detection of a critical vulnerability in FortiPortal, the…

Vulnerabilities in Apple Pay, Samsung Pay and Google Pay allow easy unauthorized purchases

During the first day of BlackHat Europe, Positive Technologies researcher Timur Yunusov…

Open source e-learning Platform Moodle used by 190,000 organizations in 246 countries has a critical RCE vulnerability

Cybersecurity specialists found a critical vulnerability in Moodle, a popular online learning…

AWS patches to fix Log4j vulnerabilities could be exploited for privilege escalation or container escape attacks

Cybersecurity specialists from Palo Alto Networks mention that patches released by Amazon…