ClickCease VMware patches three critical vulnerabilities

Join Our Popular Newsletter

Join 4,500+ Linux & Open Source Professionals!

2x a month. No spam.

VMware patches three vulnerabilities during December Patch Tuesday

Obanla Opeyemi

December 27, 2022 - TuxCare expert team

VMware has released patches for a number of vulnerabilities, including a virtual machine escape flaw, CVE-2022-31705, which was exploited during the GeekPwn 2022 hacking challenge, as part of this month’s Patch Tuesday.

VMWare assigned a CVSS severity rating of 9.3/10 to this vulnerability and alerted that a malicious actor with local administrator rights on a virtual machine could exploit it to execute code as the virtual machine’s VMX process running on the host.

The VM escape flaw, documented as CVE-2022-31705, was exploited by Ant Security researcher Yuhao Jiang on systems running fully patched VMware Fusion, ESXi and Workstation products.

“On ESXi, the exploitation is contained within the VMX sandbox whereas, on Workstation and Fusion, this may lead to code execution on the machine where Workstation or Fusion is installed,” VMware said.

Meanwhile, the critical security update with a CVSS score of 7.2 addresses two vulnerabilities (CVE-2022-31700, CVE-2022-31701) in VMware Workspace ONE Access and Identity Manager. CVE-2022-31700 is an authenticated RCE vulnerability with a CVSS score of 7.2, while CVE-2022-31701 is a broken authentication bug with a severity rating of 5.3.

The products affected by the vulnerability includes;
ESXi 8.0 (fixed in ESXi 8.0a-20842819) (fixed in ESXi 8.0a-20842819)
ESXi 7.0 (fixed in 7.0U3i-20842708) (fixed in 7.0U3i-20842708)
Fusion version 12.x (fixed in 12.2.5)
16.x Workstation (fixed in 16.2.5)
4.x/3.x Cloud Foundation (fixed in KB90336)

VMware also resolved a command injection and directory traversal security vulnerability, both tracked as CVE-2022-31702 31702, a critical severity (CVSS v3: 9.8) vulnerability in the vRNI REST API of vRealize Network Insight versions 6.2 to 6.7 that allows command injection. And CVE-2022-31703, a directory traversal flaw with low severity (CVSS v3: 7.5) that allows a threat actor to read arbitrary files from the server.

The sources for this piece include an article in SecurityAffairs.

Summary
VMware patches three critical vulnerabilities
Article Name
VMware patches three critical vulnerabilities
Description
VMware has released patches for a number of vulnerabilities, including a virtual machine escape flaw, CVE-2022-31705.
Author
Publisher Name
TuxCare
Publisher Logo

Looking to automate vulnerability patching without kernel reboots, system downtime, or scheduled maintenance windows?

Learn About Live Patching with TuxCare

Related Articles

How GPT models can be...

According to CyberArk researchers, GPT-based models like ChatGPT can be...

January 30, 2023

Attackers actively exploit Unpatched Control...

Malicious hackers have started exploiting a critical vulnerability CVE-2022-44877 in...

January 27, 2023

Attackers distribute malware via malicious...

Deep Instinct researchers reported that RATs like StrRAT and Ratty...

January 26, 2023

CircleCI partners AWS to identify...

According to CircleCI’s CTO, Rob Zuber, CircleCI is working with...

January 25, 2023

Cisco warns of authentication bypass...

A remote attacker could exploit multiple vulnerabilities in four Cisco...

January 24, 2023

IceID malware infiltrates Active Directory...

In a notable IcedID malware attack, the assailant impacted the...

January 23, 2023