VMSA-2024-0004

• VMware Aria Operations (formerly vRealize Operations)
• VMware Cloud Foundation (VMware Aria Operations)

A local privilege escalation vulnerability affecting Aria Operations was responsibly reported to VMware. Updates are available to remediate this vulnerability in affected VMware products.

VMware Aria Operations contains a local privilege escalation vulnerability. VMware has evaluated the severity of this issue to be in the Moderate Severity Range with a maximum CVSSv3 base score of 6.7.

A malicious actor with administrative access to the local system can escalate privileges to ‘root’.

To remediate CVE-2024-22235 apply the updates listed in the ‘Fixed Version’ column of the ‘Response Matrix’ below.

None.

None.

None.

VMware would like to thank thiscodecc of MoyunSec Vlab and Bing for reporting this issue to us.

Fixed Version(s) and Release Notes:

Aria Operations

Downloads and Documentation:

https://customerconnect.vmware.com/downloads/info/slug/infrastructure_operations_management/vmware_aria_operations/8_16

https://docs.vmware.com/en/VMware-Aria-Operations/8.16/rn/vmware-aria-operations-816-release-notes/index.html

Release notes

Mitre CVE Dictionary Links:

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22235

FIRST CVSSv3 Calculator:

CVE-2024-22235: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

2024-02-20 VMSA-2024-0004

Initial security advisory.

E-mail: security@vmware.com

PGP key at:
https://kb.vmware.com/kb/1055 

VMware Security Advisories
https://www.vmware.com/security/advisories 

VMware Security Response Policy
https://www.vmware.com/support/policies/security_response.html 

VMware Lifecycle Support Phases
https://www.vmware.com/support/policies/lifecycle.html 

VMware Security & Compliance Blog  
https://blogs.vmware.com/security 

Twitter
https://twitter.com/VMwareSRC

Copyright 2024 Broadcom. All rights reserved.