Alert/Advisory: Multiple vulnerabilities found in VMWare Workstation and Fusion

VMWare has released security updates that address multiple vulnerabilities (tracked as CVE-2024-22267, CVE-2024-22268, CVE-2024-22269, and CVE-2024-22270) that affect their Workstation and Fusion products. 

The vulnerabilities that affect VMWare products are: 

• CVE-2024-22267: This is a use-after-free vulnerability that can be exploited by a threat actor with local administrative privileges on a virtual machine. This allows them to execute code. 
•  CVE-2024-22268: This is a vulnerability found in the Shader functionality that would allow threat actors with non-administrative access to a virtual machine with 3D graphics enabled to create a DoS condition. 
•  CVE-2024-22269: This is an information disclosure vulnerability in the Bluetooth device that would allow threat actors with local administrative privileges on a virtual machine to read privileged information contained in hypervisor memory from a virtual machine. 
• CVE-2024-22270: This is an information disclosure vulnerability in the Host Guest File Sharing (HGFS) functionality that would allow threat actors with local administrative privileges on a virtual machine to read privileged information contained in hypervisor memory from a virtual machine.

The vulnerabilities affect Workstation versions earlier than 17.5.2, and Fusion versions earlier than 13.5.2. It is highly recommended for users and administrators to update to the latest versions immediately. 

Those who are unable to update their affected products immediately are advised to turn off the Bluetooth support on the virtual machine and disable 3D acceleration feature as a mitigation measure for CVE-2024-22267, CVE-2024-22268, and CVE-2024-22269. Unfortunately, there is no mitigation measure that addresses CVE-2024-22270, other than updating to the latest version. 

More information is available here: 

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24280

https://www.csa.gov.sg/alerts-advisories/alerts/2024/al-2024-050                                                                                                                                                                                       

https://www.bleepingcomputer.com/news/security/vmware-fixes-three-zero-day-bugs-exploited-at-pw

​

​