VMware Virtualisation

507 views

5 minute read

VMSA-2022-0030

James Dean

10 December 2022

Important

Advisory ID:
VMSA-2022-0030

CVSSv3 Range:
4.2-7.5

Issue Date:
2022-12-08

Updated On:
2022-12-08 (Initial Advisory)

CVE(s):
CVE-2022-31696, CVE-2022-31697, CVE-2022-31698, CVE-2022-31699

Synopsis:
VMware ESXi and vCenter Server updates address multiple security vulnerabilities (CVE-2022-31696, CVE-2022-31697, CVE-2022-31698, CVE-2022-31699)

1. Impacted Products

VMware ESXi
VMware vCenter Server (vCenter Server)
VMware Cloud Foundation (Cloud Foundation)

2. Introduction

Multiple vulnerabilities in VMware ESXi and vCenter Server were privately reported to VMware. Updates are available to remediate these vulnerabilities in affected VMware products.

3a. VMware ESXi memory corruption vulnerability (CVE-2022-31696)

Description

VMware ESXi contains a memory corruption vulnerability that exists in the way it handles a network socket. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.5.

Known Attack Vectors

A malicious actor with local access to ESXi may exploit this issue to corrupt memory leading to an escape of the ESXi sandbox.

Resolution

To remediate CVE-2022-31696 apply the patches listed in the ‘Fixed Version’ column of the ‘Response Matrix’ found below.

Workarounds

None.

Additional Documentation

None.

Acknowledgements

VMware would like to thank Reno Robert of Trend Micro Zero Day Initiative for reporting this issue to us.

Notes

[1] ESXi 6.7 and 6.5 have reached end-of-life. Fixed versions documented in the response matrix were released before the end-of-life date.

Response Matrix

Product	Version	Running On	CVE Identifier	CVSSv3	Severity	Fixed Version	Workarounds	Additional Documentation
ESXi	8.0	Any	CVE-2022-31696	N/A	N/A	Not impacted	N/A	N/A
ESXi	7.0	Any	CVE-2022-31696	7.5	important	ESXi70U3si-20841705	None	None
ESXi	6.7	Any	CVE-2022-31696	7.5	important	[1] ESXi670-202210101-SG	None	None
ESXi	6.5	Any	CVE-2022-31696	7.5	important	[1] ESXi650-202210101-SG	None	None

Impacted Product Suites that Deploy Response Matrix 3a Components:

Product	Version	Running On	CVE Identifier	CVSSv3	Severity	Fixed Version	Workarounds	Additional Documentation
Cloud Foundation (ESXi)	4.x	Any	CVE-2022-31696	7.5	important	KB90336	None	None
Cloud Foundation (ESXi)	3.x	Any	CVE-2022-31696	7.5	important	KB90336	None	None

3b. VMware vCenter Server information disclosure vulnerability (CVE-2022-31697)

Description

The vCenter Server contains an information disclosure vulnerability due to the logging of credentials in plaintext. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 6.2.

Known Attack Vectors

A malicious actor with access to a workstation that invoked a vCenter Server Appliance ISO operation (Install/Upgrade/Migrate/Restore) can access plaintext passwords used during that operation.

Resolution

To remediate CVE-2022-31697 apply the updates listed in the ‘Fixed Version’ column of the ‘Response Matrix’ below to affected deployments.

Workarounds

None.

Additional Documentation

None.

Acknowledgements

VMware would like to thank Zachary Kern-Wies for reporting this vulnerability to us.

Notes

[1] vCenter Server 6.7 and 6.5 have reached end-of-life. Fixed versions documented in the response matrix were released before the end-of-life date.

Response Matrix

Product	Version	Running On	CVE Identifier	CVSSv3	Severity	Fixed Version	Workarounds	Additional Documentation
vCenter Server	8.0	Any	CVE-2022-31697	N/A	N/A	Not impacted	N/A	N/A
vCenter Server	7.0	Any	CVE-2022-31697	6.2	moderate	7.0 U3i	None	None
vCenter Server	6.7	Any	CVE-2022-31697	6.2	moderate	[1] 6.7.0 U3s	None	None
vCenter Server	6.5	Any	CVE-2022-31697	6.2	moderate	[1] 6.5 U3u	None	None

Impacted Product Suites that Deploy Response Matrix 3b Components:

Product	Version	Running On	CVE Identifier	CVSSv3	Severity	Fixed Version	Workarounds	Additional Documentation
Cloud Foundation (vCenter Server)	4.x	Any	CVE-2022-31697	6.2	moderate	KB90336	None	None
Cloud Foundation (vCenter Server)	3.x	Any	CVE-2022-31697	6.2	moderate	KB90336	None	None

3c. VMware vCenter Server content library denial of service vulnerability (CVE-2022-31698)

Description

The vCenter Server contains a denial-of-service vulnerability in the content library service. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 5.8.

Known Attack Vectors

A malicious actor with network access to port 443 on vCenter Server may exploit this issue to trigger a denial-of-service condition by sending a specially crafted header.

Resolution

To remediate CVE-2022-31698 apply the updates listed in the ‘Fixed Version’ column of the ‘Response Matrix’ below to affected deployments.

Workarounds

None.

Additional Documentation

None.

Acknowledgements

VMware would like to thank Marcin ‘Icewall’ Noga of Cisco Talos for reporting this issue to us.

Notes

[1] vCenter Server 6.7 and 6.5 have reached end-of-life. Fixed versions documented in the response matrix were released before the end-of-life date.

Response Matrix

Product	Version	Running On	CVE Identifier	CVSSv3	Severity	Fixed Version	Workarounds	Additional Documentation
vCenter Server	8.0	Any	CVE-2022-31698	N/A	N/A	Not impacted	N/A	N/A
vCenter Server	7.0	Any	CVE-2022-31698	5.8	moderate	7.0 U3i	None	None
vCenter Server	6.7	Any	CVE-2022-31698	5.8	moderate	[1] 6.7.0 U3s	None	None
vCenter Server	6.5	Any	CVE-2022-31698	5.8	moderate	[1] 6.5 U3u	None	None

Impacted Product Suites that Deploy Response Matrix 3c Components:

Product	Version	Running On	CVE Identifier	CVSSv3	Severity	Fixed Version	Workarounds	Additional Documentation
Cloud Foundation (vCenter Server)	4.x	Any	CVE-2022-31698	5.8	moderate	KB90336	None	None
Cloud Foundation (vCenter Server)	3.x	Any	CVE-2022-31698	5.8	moderate	KB90336	None	None

3d. VMware ESXi OpenSLP heap overflow vulnerability (CVE-2022-31699)

Description

VMware ESXi contains a heap-overflow vulnerability. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 4.2.

Known Attack Vectors

A malicious local actor with restricted privileges within a sandbox process may exploit this issue to achieve a partial information disclosure.

Resolution

To remediate CVE-2022-31699 apply the patches listed in the ‘Fixed Version’ column of the ‘Response Matrix’ found below.

Workarounds

None.

Additional Documentation

None.

Acknowledgements

VMware would like to thank 01dwang & bibi from Bugab00 team for reporting this issue to us.

Notes

[1] ESXi 6.7 and 6.5 have reached end-of-life. Fixed versions documented in the response matrix were released before the end-of-life date.

[2] Per the Security Configuration Guides for VMware vSphere, VMware now recommends disabling the OpenSLP service in ESXi if it is not used. This service is disabled by default starting from ESXi 7.0 U2c and ESXi 8.0. For more information, see our blog posting:https://blogs.vmware.com/vsphere/2021/02/evolving-the-vmware-vsphere-security-configuration-guides.html

Response Matrix

Product	Version	Running On	CVE Identifier	CVSSv3	Severity	Fixed Version	Workarounds	Additional Documentation
[2] ESXi	8.0	Any	CVE-2022-31699	N/A	N/A	Not impacted	N/A	N/A
[2] ESXi	7.0	Any	CVE-2022-31699	4.2	moderate	ESXi70U3si-20841705	KB76372	None
[2] ESXi	6.7	Any	CVE-2022-31699	4.2	moderate	[1] ESXi670-202210101-SG	KB76372	None
[2] ESXi	6.5	Any	CVE-2022-31699	4.2	moderate	[1] ESXi650-202210101-SG	KB76372	None

Impacted Product Suites that Deploy Response Matrix 3d Components:

Product	Version	Running On	CVE Identifier	CVSSv3	Severity	Fixed Version	Workarounds	Additional Documentation
Cloud Foundation (ESXi)	4.x	Any	CVE-2022-31699	4.2	moderate	KB90336	KB76372	None
Cloud Foundation (ESXi)	3.x	Any	CVE-2022-31699	4.2	moderate	KB90336	KB76372	None