VMware ESXi, Workstation, and Fusion contain an integer-underflow in VMCI (Virtual Machine Communication Interface) that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox whereas, on Workstation and Fusion, this may lead to code execution on the machine where Workstation or Fusion is installed.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Cloud Foundation
Vendor
VMware
Product
Cloud Foundation
Platforms
Unknown
Default status
unaffected
Cloud Foundation · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
9.0.0.0, 5.x, 4.5.x
affected
Unavailable
Unavailable
Unavailable
None listed
vSphere Foundation
Vendor
VMware
Product
vSphere Foundation
Platforms
Unknown
Default status
unaffected
vSphere Foundation · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
9.0.0.0
affected
Unavailable
Unavailable
Unavailable
None listed
ESXi
Vendor
VMware
Product
ESXi
Platforms
Unknown
Default status
unaffected
ESXi · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
8.0
affected
custom
ESXi80U3f-24784735
Unavailable
None listed
8.0
affected
custom
ESXi80U2e-24789317
Unavailable
None listed
7.0
affected
custom
ESXi70U3w-24784741
Unavailable
None listed
Workstation
Vendor
VMware
Product
Workstation
Platforms
Unknown
Default status
unaffected
Workstation · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
17.x
affected
custom
17.6.4
Unavailable
None listed
Fusion
Vendor
VMware
Product
Fusion
Platforms
Unknown
Default status
unaffected
Fusion · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
13.x
affected
custom
13.6.4
Unavailable
None listed
Telco Cloud Platform
Vendor
VMware
Product
Telco Cloud Platform
Platforms
Unknown
Default status
unaffected
Telco Cloud Platform · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
5.x, 4.x, 3.x, 2.x
affected
Unavailable
Unavailable
Unavailable
None listed
Telco Cloud Infrastructure
Vendor
VMware
Product
Telco Cloud Infrastructure
Platforms
Unknown
Default status
unaffected
Telco Cloud Infrastructure · Scoped product and version facts