VMware addresses security flaws discovered during Tianfu Cup Pwn Contest

Threat Level – Amber | Vulnerability Report

THREAT LEVEL: Amber.

For a detailed advisory, download the pdf file here

VMware addressed vulnerabilities in ESXi, Workstation, Fusion, and Cloud Foundation, few months after the discovery of these bugs by participants at Tianfu Cup Pwn Contest. VMware has rated some of these vulnerabilities as important, however, chaining these issues together may result in what is effectively a critical exploit. Successfully exploiting VMware Workstation might allow attackers to perform guest-to-host escape and when combined with ESXi exploitation, it may allow them to execute code as the virtual machine’s VMX process and obtain root permissions on the host machine.

A Use-after-free vulnerability in XHCI USB controller (CVE-2021-22040) and a double-fetch vulnerability in UHCI USB controller (CVE-2021-22041) were reported. Attackers with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine’s VMX process running on the host if isochronous USB endpoint is available.

Other noted vulnerability was ESXi settingsd unauthorized access (CVE-2021-22042) which allows an attacker with privileges within the VMX process only to access settingsd service running as a high privileged user. In addition to these bugs, an ESXi settingsd TOCTOU vulnerability (CVE-2021-22043) also allows an attacker with access to settingsd to escalate their privileges by writing arbitrary files.

Organizations should apply all the patches as given below. VMware has also included workarounds in their advisories, suggesting customers that removing USB controllers from virtual machines may help resolve these issues.

Potential MITRE ATT&CK TTPs are:

TA0001: Initial Access

TA0040: Impact

TA0007: Discovery

TA0004: Privilege Escalation

TA0005: Defense Evasion

T1068: Exploitation for Privilege Escalation

T1497: Virtualization/Sandbox Evasion

T1195: Supply Chain Compromise

T1499: Endpoint Denial of Service

T1499.001: Endpoint Denial of Service: Service Exhaustion Flood