CVE-2021-22045

CWE-787 — Out-of-bounds Write4 documents4 sources
Severity
7.8HIGH
EPSS
2.1%
top 15.80%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Vmware FusionVmware WorkstationVmware Cloud Foundation+1 more
Timeline
PublishedJan 4
Latest updateJan 5

Description

VMware ESXi (7.0, 6.7 before ESXi670-202111101-SG and 6.5 before ESXi650-202110101-SG), VMware Workstation (16.2.0) and VMware Fusion (12.2.0) contains a heap-overflow vulnerability in CD-ROM device emulation. A malicious actor with access to a virtual machine with CD-ROM device emulation may be able to exploit this vulnerability in conjunction with other issues to execute code on the hypervisor from a virtual machine.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:HExploitability: 1.1 | Impact: 6.0

Affected Packages4 packages

▶NVDvmware/fusion12.0.0 — 12.2.0
▶NVDvmware/workstation16.0.0 — 16.2.0
▶NVDvmware/esxi6.5, 6.7, 7.0+2
▶NVDvmware/cloud_foundation3.0 — 3.10.2.2+1

🔴Vulnerability Details

2
GHSA
GHSA-vfgr-j794-9c26: VMware ESXi (7↗2022-01-05
▶
CVEList
CVE-2021-22045: VMware ESXi (7↗2022-01-04
▶

📋Vendor Advisories

1
VMware
VMware Workstation, Fusion and ESXi updates address a heap-overflow vulnerability (CVE-2021-22045)↗2022-01-04
▶
CVE-2021-22045 (HIGH CVSS 7.8) | VMware ESXi (7.0 | cvebase.io