CVE-2024-22254

2024-03-0518:15:48

CWE-787

vmware

web.nvd.nist.gov

112

vmware

esxi

out-of-bounds write

vulnerability

escape

sandbox

nvd

cve-2024-22254

CVSS3

7.9

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

AI Score

8.5

Confidence

High

EPSS

Percentile

9.0%

JSON

VMware ESXi contains an out-of-bounds write vulnerability. A malicious actor with privileges within the VMX process may trigger an out-of-bounds write leading to an escape of the sandbox.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "VMware ESXi",
    "vendor": "n/a",
    "versions": [
      {
        "lessThan": "ESXi80U2sb-23305545",
        "status": "affected",
        "version": "8.0",
        "versionType": "custom"
      },
      {
        "lessThan": "ESXi80U1d-23299997",
        "status": "affected",
        "version": "8.0",
        "versionType": "custom"
      },
      {
        "lessThan": "ESXi70U3p-23307199",
        "status": "affected",
        "version": "7.0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "VMware Cloud Foundation",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "5.x"
      },
      {
        "status": "affected",
        "version": "4.x"
      }
    ]
  }
]