Coming Soon...

Q-CERT website is currently under maintenance. We should be back shortly. Thank you for yor patience.

Multiple Security Vulnerabilities in VMware Products

Issued: 
Thursday, 17 February, 2022
Last Revision: 
Thursday, 17 February, 2022
Vendor: 
Severity Level: 
Summary: 

VMware has released a critical security update for its ESXi, Fusion, Workstation products, and VMware Cloud Foundation versions to address the multiple vulnerabilities. Attackers could gain access to workloads inside virtual environments by exploiting the vulnerability.

 

These security flaws could result in a variety of negative effects, including command execution, escalate privilege, misuse the service settingsd as a high-privileged user and denial-of-service attacks.

 

Vulnerabilities can be linked for even worse outcomes and combining these vulnerabilities may result in increased severity.

 

CVE/Vulnerability

Description 

CVSS3.0 Score

CVE-2021-22040

Use-after-free vulnerability in XHCI USB

8.4

CVE-2021-22041

Double-fetch vulnerability in UHCI USB

8.4

CVE-2021-22042

ESXi ‘settingsd’ unauthorized access vulnerability

8.2

CVE-2021-22043

ESXi settingsd’ TOCTOU vulnerability

8.2

CVE-2021-22050

ESXi slow HTTP POST denial of service vulnerability

5.3

 

 

Table 1: Vulnerability details 

 

 

 

CVE/Vulnerability

Affected Product(s)

Version

CVE-2021-22040

CVE-2021-22041

VMware ESXi

7.0 U1,7.0 U2,7.0 U3,6.5 and 6.7

VMware Workstation

12.x

VMware Fusion

16.x

VMware Cloud Foundation (ESXi)

3.x & 4.x

CVE-2021-22042

CVE-2021-22043

VMware ESXi

7.0 U1,7.0 U2,7.0 U3,6.5 and 6.7

VMware Cloud Foundation (ESXi)

3.x & 4.x

CVE-2021-22050

VMware ESXi

7.0, 6.5 and 6.7

VMware Cloud Foundation (ESXi)

3.x & 4.x

 

                                                                                        Table 2: Vulnerable versions                                  

 

Recommendation: 

Organizers are encouraged to upgrade the VMware impacted products to the “Fixed Version”.