Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

VMware Patches Remote Code Execution Flaw Found in Chinese Hacking Contest

VMware warned that an attacker with network access could send a specially crafted packet to execute remote code. CVSS severity score 9.8/10.

VMware vulnerability

Broadcom-owned VMware on Tuesday rolled out critical-severity patches to cover a pair of vulnerabilities in its vCenter Server platform and warned that there’s a major risk of remote code execution attacks.

The most severe of the two, tagged as CVE-2024-38812, is documented as a heap-overflow in the Distributed Computing Environment / Remote Procedure Call (DCERPC) protocol implementation within vCenter Server. 

VMware warned that an attacker with network access to the server could send a specially crafted packet to execute remote code.  The flaw carries a CVSS severity score of 9.8/10.

The second bug — CVE-2024-38813 — is described as a privilege escalation vulnerability with a maximum CVSS severity score of 7.5/10.  “A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet,” the company said.

The vulnerabilities impact VMware vCenter Server versions 7.0 and 8.0, as well as VMware Cloud Foundation versions 4.x and 5.x. VMware has provided fixed versions (vCenter Server 8.0 U3b and 7.0 U3s) and patches for Cloud Foundation users. No workarounds have been found for either vulnerability, making patching the only viable solution.

VMware credited the discovery of the issues to research teams participating in the 2024 Matrix Cup, a prominent hacking contest in China that harvests zero-days in major OS platforms, smartphones, enterprise software, browsers, and security products. 

The Matrix Cup competition took place in June this year and is sponsored by Chinese cybersecurity firm Qihoo 360 and Beijing Huayun’an Information Technology.  

Chinese law dictates that zero-day vulnerabilities found by citizens must be promptly disclosed to the government. The details of a security hole cannot be sold or provided to any third-party, apart from the product’s manufacturer. The cybersecurity industry has raised concerns that the law will help the Chinese government stockpile zero-days. 

Advertisement. Scroll to continue reading.

Indeed, one year after the law came into effect, Microsoft said it had contributed to a zero-day exploit surge. Threat actors believed to be sponsored by the Chinese government regularly leverage zero-day vulnerabilities in their attacks, including against the US government and affiliated entities. 

Zero-day vulnerabilities in VMware vCenter have been exploited in the past by Chinese-linked APT groups.

Related: Chinese Spies Exploited VMware vCenter Server Vulnerability Since 2021

Related: $2.5 Million Offered at Upcoming ‘Matrix Cup’ Chinese Hacking Contest 

Related: Microsoft Says Ransomware Gangs Exploiting VMware ESXi Flaw

Related: Exploit Code Published for Critical-Severity VMware Security Defect

Related: VMware Confirms Live Exploits Hitting Just-Patched Security Flaw

Written By

Ryan Naraine is Editor-at-Large at SecurityWeek and host of the popular Security Conversations podcast series. He is a security community engagement expert who has built programs at major global brands, including Intel Corp., Bishop Fox and GReAT. Ryan is a founding-director of the Security Tinkerers non-profit, an advisor to early-stage entrepreneurs, and a regular speaker at security conferences around the world.

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join SecurityWeek and Hitachi Vantara for this this webinar to gain valuable insights and actionable steps to enhance your organization's data security and resilience.

Register

Event: ICS Cybersecurity Conference

The leading industrial cybersecurity conference for Operations, Control Systems and IT/OT Security professionals to connect on SCADA, DCS PLC and field controller cybersecurity.

Register

People on the Move

Threat intelligence firm Intel 471 has appointed Mark Huebeler as its COO and CFO.

Omkhar Arasaratnam, former GM at OpenSSF, is LinkedIn's first Distinguised Security Engineer

Defense contractor Nightwing has appointed Tricia Fitzmaurice as Chief Growth Officer.

More People On The Move

Expert Insights

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.