VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
ESXi
Vendor
VMware
Product
ESXi
Platforms
Unknown
Default status
unaffected
ESXi · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
8.0
affected
custom
ESXi80U3d-24585383
Unavailable
None listed
8.0
affected
custom
ESXi80U2d-24585300
Unavailable
None listed
7.0
affected
custom
ESXi70U3s-24585291
Unavailable
None listed
Workstation
Vendor
VMware
Product
Workstation
Platforms
Windows
Linux
Default status
unaffected
Workstation · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
17.x
affected
custom
17.6.3
Unavailable
None listed
VMware Cloud Foundation
Vendor
VMware
Product
VMware Cloud Foundation
Platforms
Unknown
Default status
unaffected
VMware Cloud Foundation · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
5.x, 4.5.x
affected
Unavailable
Unavailable
Unavailable
None listed
Telco Cloud Platform
Vendor
VMware
Product
Telco Cloud Platform
Platforms
Unknown
Default status
unaffected
Telco Cloud Platform · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
5.x, 4.x, 3.x, 2.x
affected
Unavailable
Unavailable
Unavailable
None listed
Telco Cloud Infrastructure
Vendor
VMware
Product
Telco Cloud Infrastructure
Platforms
Unknown
Default status
unaffected
Telco Cloud Infrastructure · Scoped product and version facts