VMware addresses security flaws discovered during Tianfu Cup Pwn Contest

THREAT LEVEL: Amber. For a detailed advisory, download the pdf file here VMware addressed vulnerabilities in ESXi, Workstation, Fusion, and Cloud Foundation, few months after the discovery of these bugs by participants at Tianfu Cup Pwn Contest. VMware has rated some of these vulnerabilities as important, however, chaining these issues together may result in what is effectively a critical exploit. Successfully exploiting VMware Workstation might allow attackers to perform guest-to-host escape and when combined with ESXi exploitation, it may allow them to execute code as the virtual machine's VMX process and obtain root permissions on the host machine. A Use-after-free vulnerability in XHCI USB controller (CVE-2021-22040) and a double-fetch vulnerability in UHCI USB controller (CVE-2021-22041) were reported. Attackers with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host if isochronous USB endpoint is available. Other noted vulnerability was ESXi settingsd unauthorized access (CVE-2021-22042) which allows an attacker with privileges within the VMX process only to access settingsd service running as a high privileged user. In addition to these bugs, an ESXi settingsd TOCTOU vulnerability (CVE-2021-22043) also allows an attacker with access to settingsd to escalate their privileges by writing arbitrary files. Organizations should apply all the patches as given below. VMware has also included workarounds in their advisories, suggesting customers that removing USB controllers from virtual machines may help resolve these issues. Potential MITRE ATT&CK TTPs are: TA0001: Initial Access TA0040: Impact TA0007: Discovery TA0004: Privilege Escalation TA0005: Defense Evasion T1068: Exploitation for Privilege Escalation T1497: Virtualization/Sandbox Evasion T1195: Supply Chain Compromise T1499: Endpoint Denial of Service T1499.001: Endpoint Denial of Service: Service Exhaustion Flood Vulnerability Details Patch Link https://www.vmware.com/security/advisories/VMSA-2022-0004.html References https://www.securityweek.com/vmware-patches-vulnerabilities-reported-researchers-chinese-government https://www.zdnet.com/article/vmware-patches-released-after-vulnerabilities-found-during-tianfu-cup/