CVE-2024-22254: Out-of-bounds write vulnerability
Published Mar 5, 2024
·Updated
VMware ESXi contains an out-of-bounds write vulnerability. A malicious actor with privileges within the VMX process may trigger an out-of-bounds write leading to an escape of the sandbox.
Affected Software
36 affected components
VMware ESXi
VMware Cloud Foundation>=4.0<=5.0
VMware ESXi=7.0
VMware ESXi=7.0-update_1
VMware ESXi=7.0-update_1a
VMware ESXi=7.0-update_1b
VMware ESXi=7.0-update_1c
VMware ESXi=7.0-update_1d
VMware ESXi=7.0-update_1e
VMware ESXi=7.0-update_2
VMware ESXi=7.0-update_2a
VMware ESXi=7.0-update_2c
VMware ESXi=7.0-update_2d
VMware ESXi=7.0-update_2e
VMware ESXi=7.0-update_3
VMware ESXi=7.0-update_3c
VMware ESXi=7.0-update_3d
VMware ESXi=7.0-update_3e
VMware ESXi=7.0-update_3f
VMware ESXi=7.0-update_3g
VMware ESXi=7.0-update_3i
VMware ESXi=7.0-update_3j
VMware ESXi=7.0-update_3k
VMware ESXi=7.0-update_3l
VMware ESXi=7.0-update_3m
VMware ESXi=7.0-update_3n
VMware ESXi=7.0-update_3o
VMware ESXi=7.0.0-b
VMware ESXi=8.0
VMware ESXi=8.0-a
VMware ESXi=8.0-b
VMware ESXi=8.0-c
VMware ESXi=8.0-update_1
VMware ESXi=8.0-update_1a
VMware ESXi=8.0-update_1c
VMware ESXi=8.0-update_2
Event History
Mar 5, 2024
CVE Published
via MITRE·05:58 PM
Data Sourced
via MITRE·05:58 PM
DescriptionSeverity
Mar 6, 2024
News Published
via BleepingComputer·03:39 PM
News Published
via BleepingComputer·03:40 PM
Mar 7, 2024
News Published
via The Register·07:30 AM
Mar 11, 2024
News Published
via The Register·07:35 AM
Frequently Asked Questions
1
What is the severity of CVE-2024-22254?
CVE-2024-22254 is classified as a critical vulnerability due to the potential for sandbox escape.
2
How do I fix CVE-2024-22254?
To fix CVE-2024-22254, users should update to the latest version of VMware ESXi as per VMware's security advisories.
3
Who is affected by CVE-2024-22254?
CVE-2024-22254 affects VMware ESXi users with privileges within the VMX process.
4
What type of vulnerability is CVE-2024-22254?
CVE-2024-22254 is an out-of-bounds write vulnerability.
5
What can an attacker do with CVE-2024-22254?
An attacker exploiting CVE-2024-22254 could potentially escape the sandbox of the affected VMware ESXi instance.