Vulnerabilities

VMware Struggles to Fix Flaw Exploited at Chinese Hacking Contest

For the second time in as many months, VMware patches a remote code execution vulnerability first exploited at a Chinese hacking contest in June.

Ryan Naraine

Published

October 21, 2024

VMware

VMware appears to be having trouble patching a nasty code execution flaw in its vCenter Server platform.

For the second time in as many months, the virtualization tech vendor pushed a patch to cover a remote code execution vulnerability first documented — and exploited — at a Chinese hacking contest earlier this year.

“VMware by Broadcom has determined that the vCenter patches released on September 17, 2024 did not fully address CVE-2024-38812,” the company said in an updated advisory on Monday. No additional details were provided.

The vulnerability is described as a heap-overflow in the Distributed Computing Environment / Remote Procedure Call (DCERPC) protocol implementation within vCenter Server. It carries a CVSS severity score of 9.8/10.

A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution, VMware warned.

When the first patch was issued last month, VMware credited the discovery of the issues to research teams participating in the 2024 Matrix Cup, a prominent hacking contest in China that harvests zero-days in major OS platforms, smartphones, enterprise software, browsers, and security products.

Advertisement. Scroll to continue reading.

The Matrix Cup competition took place in June this year and is sponsored by Chinese cybersecurity firm Qihoo 360 and Beijing Huayun’an Information Technology.

According to Chinese law, zero-day vulnerabilities found by citizens must be promptly disclosed to the government. The details of a security hole cannot be sold or provided to any third-party, apart from the product’s manufacturer. The cybersecurity industry has raised concerns that the law will help the Chinese government stockpile zero-days.

The new VCenter Server patch also provides cover for CVE-2024-38813, privilege escalation bug with a CVSS severity score of 7.5/10.

“A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet,” VMware warned.