Issued: Thursday, 17 February, 2022 |
Last Revision: Thursday, 17 February, 2022 |
Vendor: |
Product: |
Severity Level: |
VMware has released a critical security update for its ESXi, Fusion, Workstation products, and VMware Cloud Foundation versions to address the multiple vulnerabilities. Attackers could gain access to workloads inside virtual environments by exploiting the vulnerability.
These security flaws could result in a variety of negative effects, including command execution, escalate privilege, misuse the service settingsd as a high-privileged user and denial-of-service attacks.
Vulnerabilities can be linked for even worse outcomes and combining these vulnerabilities may result in increased severity.
CVE/Vulnerability | Description | CVSS3.0 Score |
CVE-2021-22040 | Use-after-free vulnerability in XHCI USB | 8.4 |
CVE-2021-22041 | Double-fetch vulnerability in UHCI USB | 8.4 |
CVE-2021-22042 | ESXi ‘settingsd’ unauthorized access vulnerability | 8.2 |
CVE-2021-22043 | ESXi settingsd’ TOCTOU vulnerability | 8.2 |
CVE-2021-22050 | ESXi slow HTTP POST denial of service vulnerability | 5.3 |
Table 1: Vulnerability details
CVE/Vulnerability | Affected Product(s) | Version |
CVE-2021-22040 CVE-2021-22041 | VMware ESXi | 7.0 U1,7.0 U2,7.0 U3,6.5 and 6.7 |
VMware Workstation | 12.x | |
VMware Fusion | 16.x | |
VMware Cloud Foundation (ESXi) | 3.x & 4.x | |
CVE-2021-22042 CVE-2021-22043 | VMware ESXi | 7.0 U1,7.0 U2,7.0 U3,6.5 and 6.7 |
VMware Cloud Foundation (ESXi) | 3.x & 4.x | |
CVE-2021-22050 | VMware ESXi | 7.0, 6.5 and 6.7 |
VMware Cloud Foundation (ESXi) | 3.x & 4.x |
Table 2: Vulnerable versions
Organizers are encouraged to upgrade the VMware impacted products to the “Fixed Version”.
