Summary

VMware has released a critical security advisory (VMSA-2024-0019) that addresses two serious vulnerabilities found in its vCenter Server and VMware Cloud Foundation products.

These vulnerabilities, identified as CVE-2024-38812 and CVE-2024-38813, could enable attackers to execute remote code and gain elevated privileges, posing a significant security risk.

Affected Systems and/or Application

VMware vCenter and any products that contain vCenter, including VMware vSphere and VMware Cloud Foundation are affected:

The following table captures the essential details about the affected VMware products, versions, identified vulnerabilities, severity, and the fixed versions.

Technical Details / Attack Overview

CVE-2024-38812: Heap-Overflow Vulnerability

The first vulnerability, identified as CVE-2024-38812, is a heap overflow fl aw in the way the vCenter Server handles theDCERPC protocol, according to a report from Broadcom. This vulnerability has a critical severity rating, with a maximumCVSSv3 score of 9.8. It allows attackers with access to the vCenter Server to exploit the issue by sending specifically crafted network packets. If successful, the attack could enable remote code execution, giving the attackers control over the compromised system.

CVE-2024-38813: Privilege Escalation Vulnerability

CVE-2024-38813 is a vulnerability that allows attackers with network access to elevate their privileges to root by sending specially crafted network packets. It has a CVSSv3 score of 7.5, making it a critical issue. Similar to the heap overflow vulnerability, this flaw can be exploited remotely, enabling attackers to gain higher-level access through malicious network activity.

Recommendations

1. Update Affected Systems:

• VMware has released updates to fix the vulnerabilities, and users are encouraged to apply the updates listed in the “Fixed Version” column of the response matrix to protect their systems.
• There are no in-product workarounds available for CVE-2024-38812. VMware has provided a supplementalFAQ for more information on this issue. Similarly, no workarounds exist for CVE-2024-38813, and additional documentation is available through another FAQ provided by VMware.
• Fixed Version(s) and Release Notes:
• VMware vCenter Server 8.0 U3b. Downloads and Documentation: https://support.broadcom.com/web/ecx/solutiondetails?patchId=5515https://docs.vmware.com/en/VMware-vSphere/8.0/rn/vsphere-vcenter-server-80u3b-release-notes/index.html
• VMware vCenter Server 7.0 U3s. Downloads and Documentation:
  https://support.broadcom.com/web/ecx/solutiondetails?patchId=5513https://docs.vmware.com/en/VMware-vSphere/7.0/rn/vsphere-vcenter-server-70u3s-release-notes/index.html
• KB Articles: Cloud Foundation 5.x/4.x:
  https://knowledge.broadcom.com/external/article?legacyId=88287
• Mitre CVE Dictionary Links:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-38812
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-38813
• FIRST CVSSv3 Calculator:
  CVE-2024-38812: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  CVE-2024-38813: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

General Recommendations

Before updating your VMware vCenter Server appliance to address the critical vulnerability, it’s recommended to take a non-memory snapshot of the appliance. This acts as a fail-safe, allowing you to revert back if anything goes wrong during the update process.

To do this, log into the ESXi host that manages the vCenter appliance and create a non-memory snapshot of theVCSA (vCenter Server Appliance) VM. Once the snapshot is in place, you can safely proceed with pulling, staging, and applying the update for the vulnerability.

What is the CFC doing ?

Kudelski Security has not observed or received indicators of active exploitation of these flaws. The CFC will continue to monitor the situation and send an advisory update if needed. Clients with vulnerability scan services will receive relevant results if critical vulnerabilities are found within the scope of the scans as soon as a plugin will be made available by the vuln scan provider.

References

VMware vCenter Server Vulnerability-Attackers Escalate Privileges (gbhackers.com)

Critical VMware vCenter Server Patch VMSA-2024-0019 – Upgrade Now! – Virtualization Howto