CVE Vulnerability Advisory Database

[Affected Scope] VMware ESXi, Workstation, and Fusion environments utilizing the Host-Guest File System (HGFS) for file sharing.

[Impact] A malicious actor with local administrative privileges on a guest VM can read out-of-bounds memory from the host's vmx process, potentially bypassing ASLR to facilitate hypervisor escape.

[Mitigation] Apply the official security patches provided by Broadcom, or disable the HGFS (Shared Folders) feature in the virtual machine configuration as a temporary workaround.

[Affected Scope] Virtual machines and environments running on VMware ESXi hypervisors where attackers hold privileges within the VMX process

[Impact] Escape of the hypervisor sandbox and potential host takeover via arbitrary kernel write from the guest OS

[Mitigation] Immediately apply the official security patches provided by Broadcom and restrict administrative access to the VMX process

[Affected Scope] VMware ESXi and Workstation products

[Impact] A malicious actor with local administrative privileges on a guest VM can execute arbitrary code within the host's VMX process, leading to a virtual machine escape

[Mitigation] Apply the latest security patches provided by Broadcom and restrict administrative access within guest virtual machines

[Affected Scope] VMware ESXi hosts configured to use Active Directory (AD) for user management.

[Impact] A malicious actor with group creation permissions in AD can gain full administrative access to the ESXi host by re-creating the deleted 'ESXi Admins' group.

[Mitigation] Apply the official security patches from Broadcom or change the default ESXi Admins group setting to an unprivileged/non-existent group name.

[Affected Scope] Guest virtual machines running on VMware ESXi hosts with vulnerable versions of VMware Tools or open-vm-tools installed

[Impact] A fully compromised ESXi host can bypass host-to-guest authentication, compromising the confidentiality and integrity of the guest operating system

[Mitigation] Immediately upgrade VMware Tools and open-vm-tools to the latest patched versions provided by VMware and OS vendors

[Affected Scope] Any network devices, virtualization hosts (such as VMware ESXi), and storage systems exposed to the internet with the Service Location Protocol (SLP, RFC 2608) enabled

[Impact] Unauthenticated remote attackers can leverage spoofed UDP traffic to launch massive reflective Denial-of-Service (DDoS) attacks, achieving an extreme amplification factor of up to 2,200x

[Mitigation] Immediately block external access to SLP ports (UDP/TCP 427) or completely disable the SLP daemon in environments where it is not required

[Affected Scope] VMware ESXi 7.0 (prior to ESXi_7.0.1-0.0.16850804), 6.7 (prior to ESXi670-202010401-SG), and 6.5 (prior to ESXi650-202010401-SG)

[Impact] A malicious actor with access to port 427 on the management network can trigger a Use-After-Free in the OpenSLP service, leading to unauthenticated Remote Code Execution (RCE)

[Mitigation] Apply the official VMware security patches immediately, or disable the OpenSLP service on ESXi hosts as a temporary workaround

[Affected Scope] OpenSLP service running on VMware ESXi and Horizon DaaS appliances.

[Impact] Unauthenticated remote attackers can execute arbitrary code or fully compromise the host by sending malicious SLP messages over the network.

[Mitigation] Apply official VMware security patches immediately, or disable the SLP service and block port 427 (TCP/UDP) as a temporary workaround.