CVE-2021-22045: VMware ESXi (7.0, 6.7 before ESXi670-202111101-SG and 6.5 before ESXi650-202110101-SG), VMware Workstation (16.2.0) and VMware Fusion (12.2.0) contains a heap-overflow…

Description

VMware ESXi (7.0, 6.7 before ESXi670-202111101-SG and 6.5 before ESXi650-202110101-SG), VMware Workstation (16.2.0) and VMware Fusion (12.2.0) contains a heap-overflow vulnerability in CD-ROM device emulation. A malicious actor with access to a virtual machine with CD-ROM device emulation may be able to exploit this vulnerability in conjunction with other issues to execute code on the hypervisor from a virtual machine.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack vector

Local

Complexity

High

Privileges

Low

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)4.7% · higher than 92% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

ES

ESXi · VMware

6.5; 6.5; 6.5; 6.5; 6.5; 6.5; +34 more · source: NVD

CF

Cloud Foundation · Vmware

3.0 through 3.10.2.2; 4.0 through 4.3.1 · source: NVD

FU

Fusion · Vmware

12.0.0 before 12.2.0 · source: NVD

WO

Workstation · Vmware

16.0.0 before 16.2.0 · source: NVD