{"uuid": "7e3e648f-3bbd-4e42-8649-1aa04a6efe83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22045", "type": "seen", "source": "https://t.me/hacking_Attack/37771", "content": "Black Hat Ethical Hacking\nPartially Unpatched VMware Bug Opens Door to Hypervisor Takeover\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Partially Unpatched VMware Bug Opens Door to Hypervisor TakeoverPost Views: 162 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 2 Minutes\nA security vulnerability in VMware\u2019s Cloud Foundation, ESXi, Fusion and Workstation platforms could pave the way for hypervisor takeover in virtual environments \u2013 and a patch is still pending for some users.\nThe issue affects a wide swath of the virtualization specialist\u2019s portfolio and affects Windows, Linux and Mac users. Details about the platforms:\n\n* Cloud Foundation is VMware\u2019s multicloud management platform, providing software-defined services for compute, storage, network, security, Kubernetes and so on.\n* ESXi is a bare-metal hypervisor that installs on a server and partitions it into multiple virtual machines (VMs).\n* Fusion is a software hypervisor that allows Intel-based Macs to run VMs with guest operating systems \u2013 such as Microsoft Windows, Linux, NetWare, Solaris or macOS.\n* Workstation enables users to set up VMs on a single physical machine.\nThe bug (CVE-2021-22045) is a high-severity heap-overflow vulnerability carrying a CVSS rating of 7.7 out of 10. Heap overflows are memory issues that can result in data corruption or unexpected behavior by any process that accesses the affected memory area \u2013 in some cases resulting in remote code execution (RCE).\n\nIn this case, the problem specifically exists in the CD-ROM device emulation function of the affected products.\n\n\u201cA malicious actor with access to a virtual machine with CD-ROM device emulation may be able to exploit this vulnerability in conjunction with other issues, to execute code on the hypervisor from a virtual machine,\u201d the vendor noted in its advisory. \u201cSuccessful exploitation requires a CD image to be attached to the virtual machine.\u201d\nSee Also: Complete Offensive Security and Ethical Hacking Course\nReno Robert, senior vulnerability researcher for Trend Micro\u2019s Zero Day Initiative, told Threatpost that the issue results from \u201cthe lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer.\u201d Complex but Dangerous ExploitationRobert added that even though the bug allows an untrusted guest OS user to execute code on the hypervisor, \u201can attacker would not have control over the data written, so exploitation this would be difficult.\u201d\n\nHence the need to be used \u201cin conjunction with other issues.\u201d Reno explained that an example of other issues \u201ccould be an information-disclosure vulnerability that provide details on the memory layout. This would making exploitation more feasible.\u201d\n\nIf successful though, attackers could compromise the host operating system of the hypervisor.\u00a0Taking over a hypervisor, which is the highly privileged software that creates and runs VMs and governs how resources are shared among them (such as memory and processing), can give cybercriminals a clear path to accessing any of the data or applications stored in the VMs it controls, and executing code or installing files on those VMs, depending on the security controls that are implemented.\n\nResearcher \u201cJaanus K\\xc3\\xa4\\xc3\\xa4p\u201d with Clarified Security and Trend Micro\u2019s ZDI were credited with discovering the bug.\nSee Also: Hackers start pushing malware in worldwide Log4Shell attacks Patch VMware CVE-2021-22045 NowAffected product versions are: ESXi 6.5, 6.7 and 7 (version 7 remains unpatched for now); Fusion 12.x; Workstation 16.x; and all versions [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:22.828890Z"}