Use After Free in Vmware Cloud_foundation

CVE-2021-22040

VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machi…

Vulnerability class: Use-After-Free

EPSS: 0.007 (50.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.7 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

Affected products

  • Vmware Cloud_foundation
  • Vmware Esxi — versions 6.5, 6.7, 7.0
  • Vmware Fusion
  • Vmware Workstation_player
  • Vmware Workstation_pro
  • N/a Vmware Esxi , Workstation, Fusion And Cloud Foundation — versions VMware ESXi (7.0 U3 before ESXi70U3c-19193900, 7.0 U2 before ESXi70U2e-19290878, 7.0 U1 before ESXi70U1e-19324898, ESXi 6.7 before ESXi670-202111101-SG and ESXi 6.5 ESXi650-202202401-SG), Workstation (16.x before 16.2.1), Fusion (12.x before 12.2.1) and VMware Cloud Foundation (4.x before 4.4 and 3.x before 3.11)

Weakness classification (CWE)

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2021-22040?
CVE-2021-22040 is a medium-severity vulnerability in Vmware Cloud_foundation, classified under Use After Free. CVSS score: 6.7/10. Published 2022-02-16.
How severe is CVE-2021-22040?
Medium severity. CVSS v3 base score is 6.7 out of 10.
Is CVE-2021-22040 known to be exploited?
2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.