ZDI-24-529: (Pwn2Own) VMware Workstation UrbBuf_getDataBuf Uninitialized Variable Information Disclosure Vulnerability
This vulnerability allows local attackers to disclose sensitive information on affected installations of VMware Workstation. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.0. The following CVEs are assigned: CVE-2024-22269.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-24-529?
The severity of ZDI-24-529 is classified as medium due to the potential for local attackers to disclose sensitive information.
How do I fix ZDI-24-529?
To fix ZDI-24-529, ensure that you apply the latest patches or updates provided by VMware for the affected versions of Workstation.
What causes the ZDI-24-529 vulnerability?
The ZDI-24-529 vulnerability is caused by improper access control that allows local attackers to execute high-privileged code to gain sensitive information.
Who is affected by ZDI-24-529?
Users of VMware Workstation who have not updated to the latest security patches are affected by ZDI-24-529.
Can ZDI-24-529 be exploited remotely?
No, ZDI-24-529 requires an attacker to have local access to the target guest system to exploit the vulnerability.