• VMware ESXi
• VMware Workstation Pro / Player (Workstation)
• VMware Fusion Pro / Fusion (Fusion)
• VMware Cloud Foundation (Cloud Foundation)

Multiple vulnerabilities in VMware ESXi, Workstation, and Fusion were privately reported to VMware. Updates are available to remediate these vulnerabilities in affected VMware products.

The individual vulnerabilities documented on this VMSA for ESXi have severity Important but combining these issues will result in Critical severity.

VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB controller. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.3 for Workstation/Fusion and in the Important severity range with a maximum CVSSv3 base score of 8.4 for ESXi.

A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox whereas, on Workstation and Fusion, this may lead to code execution on the machine where Workstation or Fusion is installed.

To remediate CVE-2024-22252 apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' found below.

Workarounds for CVE-2024-22252 have been listed in the 'Workarounds' column of the 'Response Matrix' below.

A supplemental FAQ was created for clarification. Please see: https://core.vmware.com/resource/vmsa-2024-0006-questions-answers

None.

VMware would like to thank Jiang YuHao, Ying XingLei & Zhang ZiMing of Team Ant Lab working with the 2023 Tianfu Cup Pwn Contest and Jiaqing Huang (@s0duku) & Hao Zheng (@zhz) from TianGong Team of Legendsec at Qi'anxin Group for independently reporting this issue to us.

VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the UHCI USB controller. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.3 for Workstation/Fusion and in the Important severity range with a maximum CVSSv3 base score of 8.4 for ESXi.

A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox whereas, on Workstation and Fusion, this may lead to code execution on the machine where Workstation or Fusion is installed.

To remediate CVE-2024-22253 apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' found below.

Workarounds for CVE-2024-22253 have been listed in the 'Workarounds' column of the 'Response Matrix' below.

A supplemental FAQ was created for clarification. Please see: https://core.vmware.com/resource/vmsa-2024-0006-questions-answers

None.

VMware would like to thank VictorV and Wei of Team CyberAgent working with the 2023 Tianfu Cup Pwn Contest for reporting this issue to us.

VMware ESXi contains an out-of-bounds write vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.9.

A malicious actor with privileges within the VMX process may trigger an out-of-bounds write leading to an escape of the sandbox.

To remediate CVE-2024-22254 apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' found below.

None.

None.

VMware would like to thank Jiang YuHao, Ying XingLei & Zhang ZiMing of Team Ant Lab working with the 2023 Tianfu Cup Pwn Contest for reporting this issue to us.

VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability in the UHCI USB controller. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.1.

A malicious actor with administrative access to a virtual machine may be able to exploit this issue to leak memory from the vmx process.  

To remediate CVE-2024-22255 apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' found below.

Workarounds for CVE-2024-22255 have been listed in the 'Workarounds' column of the 'Response Matrix' below.

A supplemental FAQ was created for clarification. Please see: https://core.vmware.com/resource/vmsa-2024-0006-questions-answers

None.

VMware would like to thank VictorV & Wei of Team CyberAgent working with the 2023 Tianfu Cup Pwn Contest Contest and Jiaqing Huang (@s0duku) & Hao Zheng (@zhz) from TianGong Team of Legendsec at Qi'anxin Group for independently reporting this issue to us.