Use After Free in VMware Cloud Foundation

CVE-2021-22040

VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.

Vulnerability class: Use-After-Free

Published · last modified .

CVSS v3 metric

CVSS v3 base score 6.7 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.007 (53.6th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 54th percentile — 53.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2021-22040: held from 0.007 to 0.007.

EPSS over last 30 days · oldest: 0.007 · newest: 0.007 · change: 0.000

Affected products

  • VMware Cloud Foundation
  • VMware Esxi — versions 6.5, 6.7, 7.0
  • VMware Fusion
  • VMware Workstation Player
  • VMware Workstation Pro
  • VMware Esxi , Workstation, Fusion And Cloud Foundation — versions VMware ESXi (7.0 U3 before ESXi70U3c-19193900, 7.0 U2 before ESXi70U2e-19290878, 7.0 U1 before ESXi70U1e-19324898, ESXi 6.7 before ESXi670-202111101-SG and ESXi 6.5 ESXi650-202202401-SG), Workstation (16.x before 16.2.1), Fusion (12.x before 12.2.1) and VMware Cloud Foundation (4.x before 4.4 and 3.x before 3.11)

Weakness classification (CWE)

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2021-22040?
CVE-2021-22040 is a medium-severity vulnerability in VMware Cloud Foundation, classified under Use After Free. CVSS score: 6.7/10. Published 2022-02-16.
How severe is CVE-2021-22040?
Medium severity. CVSS v3 base score is 6.7 out of 10.
Is CVE-2021-22040 known to be exploited?
2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.