Now on Demand: CISO Forum Virtual Summit - All Sessions Available to Watch Instantly
Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

VMware Struggles to Fix Flaw Exploited at Chinese Hacking Contest

For the second time in as many months, VMware patches a remote code execution vulnerability first exploited at a Chinese hacking contest in June.

VMware vulnerability

VMware appears to be having trouble patching a nasty code execution flaw in its vCenter Server platform.

For the second time in as many months, the virtualization tech vendor pushed a patch to cover a remote code execution vulnerability first documented — and exploited — at a Chinese hacking contest earlier this year.

“VMware by Broadcom has determined that the vCenter patches released on September 17, 2024 did not fully address CVE-2024-38812,” the company said in an updated advisory on Monday.  No additional details were provided.

The vulnerability is described as a heap-overflow in the Distributed Computing Environment / Remote Procedure Call (DCERPC) protocol implementation within vCenter Server. It carries a CVSS severity score of 9.8/10.

A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution, VMware warned.

When the first patch was issued last month, VMware credited the discovery of the issues to research teams participating in the 2024 Matrix Cup, a prominent hacking contest in China that harvests zero-days in major OS platforms, smartphones, enterprise software, browsers, and security products. 

The Matrix Cup competition took place in June this year and is sponsored by Chinese cybersecurity firm Qihoo 360 and Beijing Huayun’an Information Technology.  

According to Chinese law, zero-day vulnerabilities found by citizens must be promptly disclosed to the government. The details of a security hole cannot be sold or provided to any third-party, apart from the product’s manufacturer. The cybersecurity industry has raised concerns that the law will help the Chinese government stockpile zero-days. 

Advertisement. Scroll to continue reading.

The new VCenter Server patch also provides cover for CVE-2024-38813,  privilege escalation bug with a CVSS severity score of 7.5/10.

“A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet,” VMware warned.

Related: VMware Patches Code Execution Flaw Found in Chinese Hacking Contest

Related: VMware Patches High-Severity SQL Injection Flaw in HCX Platform 

Related: Chinese Spies Exploited VMware vCenter Server Vulnerability Since 2021

Related: $2.5 Million Offered at Upcoming ‘Matrix Cup’ Chinese Hacking Contest

Written By

Ryan Naraine is Editor-at-Large at SecurityWeek and host of the popular Security Conversations podcast series. He is a security community engagement expert who has built programs at major global brands, including Intel Corp., Bishop Fox and GReAT. Ryan is a founding-director of the Security Tinkerers non-profit, an advisor to early-stage entrepreneurs, and a regular speaker at security conferences around the world.

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join SecurityWeek and Hitachi Vantara for this this webinar to gain valuable insights and actionable steps to enhance your organization's data security and resilience.

Register

Event: ICS Cybersecurity Conference

The leading industrial cybersecurity conference for Operations, Control Systems and IT/OT Security professionals to connect on SCADA, DCS PLC and field controller cybersecurity.

Register

People on the Move

Secure enterprise browser provider Menlo Security has appointed Bill Robbins as President.

Erik Rolf has joined Booz Allen Hamilton as the Business Information Security Officer (BISO) of Commercial Sector.

Gant Redmon has joined Trustle as its new Chief Executive Officer and Board Director.

More People On The Move

Expert Insights

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.