Vulnerability in VMware Cloud Foundation

CVE-2021-22041

VMware ESXi, Workstation, and Fusion contain a double-fetch vulnerability in the UHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.

EPSS: 0.006 (44.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.7 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

Affected products

  • Vmware Cloud_foundation
  • Vmware Esxi — versions 6.5, 6.7, 7.0
  • Vmware Fusion
  • Vmware Workstation
  • N/a Vmware Esxi , Workstation, Fusion And Cloud Foundation — versions VMware ESXi (7.0 U3 before ESXi70U3c-19193900, 7.0 U2 before ESXi70U2e-19290878, 7.0 U1 before ESXi70U1e-19324898, ESXi 6.7 before ESXi670-202111101-SG and ESXi 6.5 ESXi650-202202401-SG), Workstation (16.x before 16.2.1), Fusion (12.x before 12.2.1) and VMware Cloud Foundation (4.x before 4.4 and 3.x before 3.11)

References

Frequently asked questions

What is CVE-2021-22041?
CVE-2021-22041 is a medium-severity vulnerability in VMware Cloud Foundation. CVSS score: 6.7/10. Published 2022-02-16.
How severe is CVE-2021-22041?
Medium severity. CVSS v3 base score is 6.7 out of 10.