VMSA-2022-0020

James Dean

3 years ago

Moderate

Advisory ID:
VMSA-2022-0020

CVSSv3 Range:
5.6

Issue Date:
2022-07-12

Updated On:
2022-07-12 (Initial Advisory)

CVE(s):
CVE-2022-29901, CVE-2022-28693, CVE-2022-23816, CVE-2022-23825

Synopsis:
VMware ESXi addresses Return-Stack-Buffer-Underflow and Branch Type Confusion vulnerabilities

1. Impacted Products

VMware ESXi
VMware Cloud Foundation

2. Introduction

Multiple side-channel vulnerabilities in Intel (CVE-2022-29901, CVE-2022-28693) and AMD (CVE-2022-23816, CVE-2022-23825) CPUs have been disclosed. Patches are available to mitigate these vulnerabilities in affected VMware products.

3. Return-Stack-Buffer-Underflow (CVE-2022-29901, CVE-2022-28693) and Branch Type Confusion (CVE-2022-23816, CVE-2022-23825) vulnerabilities

Description

VMware ESXi contains Return-Stack-Buffer-Underflow (CVE-2022-29901, CVE-2022-28693) and Branch Type Confusion (CVE-2022-23816, CVE-2022-23825) vulnerabilities due to the Intel and AMD processors it utilizes. VMware has evaluated the severity of these issues to be in the Moderate severity range with a maximum CVSSv3 base score of 5.6.

Known Attack Vectors

A malicious actor with administrative access to a virtual machine can take advantage of various side-channel CPU flaws that may leak information stored in physical memory about the hypervisor or other virtual machines that reside on the same ESXi host.

Resolution

To mitigate CVE-2022-29901, CVE-2022-28693, CVE-2022-23816, and CVE-2022-23825, apply the patches listed in the ‘Fixed Version’ column of the ‘Resolution Matrix’ found below. These patches do not introduce performance impact.

Workarounds

None.

Additional Documentation

A supplemental FAQ was created for additional clarification.

Notes

None.

Acknowledgements

None.

Response Matrix:

Product	Version	Running On	CVE Identifier	CVSSv3	Severity	Fixed Version	Workarounds	Additional Documentation
ESXi	7.0	Any	CVE-2022-29901, CVE-2022-28693, CVE-2022-23816, CVE-2022-23825	5.6	moderate	ESXi70U3sf-20036586	None	FAQ
ESXi	6.7	Any	CVE-2022-29901, CVE-2022-28693, CVE-2022-23816, CVE-2022-23825	5.6	moderate	ESXi670-202207401-SG	None	FAQ
ESXi	6.5	Any	CVE-2022-29901, CVE-2022-28693, CVE-2022-23816, CVE-2022-23825	5.6	moderate	ESXi650-202207401-SG	None	FAQ

Impacted Product Suites that Deploy Response Matrix Components:

Product	Version	Running On	CVE Identifier	CVSSv3	Severity	Fixed Version	Workarounds	Additional Documentation
Cloud Foundation (ESXi)	4.x	Any	CVE-2022-29901, CVE-2022-28693, CVE-2022-23816, CVE-2022-23825	5.6	moderate	Patch Pending	None	FAQ
Cloud Foundation (ESXi)	3.x	Any	CVE-2022-29901, CVE-2022-28693, CVE-2022-23816, CVE-2022-23825	5.6	moderate	KB88927	None	FAQ