CVE-2022-31705

Published on: Not Yet Published

Last Modified on: 12/19/2022 03:43:00 PM UTC

CVE-2022-31705

Source: Mitre Source: NIST CVE.ORG Print: PDF PDF
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Certain versions of Mac Os X from Apple contain the following vulnerability:

VMware ESXi, Workstation, and Fusion contain a heap out-of-bounds write vulnerability in the USB 2.0 controller (EHCI). A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox whereas, on Workstation and Fusion, this may lead to code execution on the machine where Workstation or Fusion is installed.

  • CVE-2022-31705 has been assigned by URL Logo [email protected] to track the vulnerability - currently rated as HIGH severity.

CVSS3 Score: 8.2 - HIGH

Attack
Vector ⓘ		 Attack
Complexity		 Privileges
Required		 User
Interaction
LOCAL LOW HIGH NONE
Scope Confidentiality
Impact		 Integrity
Impact		 Availability
Impact
CHANGED HIGH HIGH HIGH

CVE References

Description Tags ⓘ Link
VMSA-2022-0033 www.vmware.com
text/html
 URL Logo MISC www.vmware.com/security/advisories/VMSA-2022-0033.html
By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].

Related QID Numbers

  • 216301 VMware ESXi 7.0 Patch Release ESXi70U3si-20841705 Missing (VMSA-2022-0033)
  • 216302 VMware ESXi 8.0 Patch Release ESXi80a-20842819 Missing (VMSA-2022-0033)
  • 377837 VMware Workstation Heap Out-Of-Bounds Write Vulnerability (VMSA-2022-0033)
  • 377839 VMware Fusion Heap Out-Of-Bounds Write Vulnerability (VMSA-2022-0033)

Exploit/POC from Github

CVE-2022-31705 (Geekpwn 2022 Vmware EHCI OOB) POC

Known Affected Configurations (CPE V2.3)

Type Vendor Product Version Update Edition Language
Operating
System		AppleMac Os X-AllAllAll
Operating
System		VmwareEsxi7.0-AllAll
Operating
System		VmwareEsxi7.0betaAllAll
Operating
System		VmwareEsxi7.0update_1AllAll
Operating
System		VmwareEsxi7.0update_1aAllAll
Operating
System		VmwareEsxi7.0update_1bAllAll
Operating
System		VmwareEsxi7.0update_1cAllAll
Operating
System		VmwareEsxi7.0update_1dAllAll
Operating
System		VmwareEsxi7.0update_1eAllAll
Operating
System		VmwareEsxi7.0update_2AllAll
Operating
System		VmwareEsxi7.0update_2aAllAll
Operating
System		VmwareEsxi7.0update_2cAllAll
Operating
System		VmwareEsxi7.0update_2dAllAll
Operating
System		VmwareEsxi7.0update_2eAllAll
Operating
System		VmwareEsxi7.0update_3cAllAll
Operating
System		VmwareEsxi7.0update_3dAllAll
Operating
System		VmwareEsxi7.0update_3eAllAll
Operating
System		VmwareEsxi7.0update_3fAllAll
Operating
System		VmwareEsxi7.0update_3gAllAll
Operating
System		VmwareEsxi8.0-AllAll
ApplicationVmwareFusionAllAllAllAll
ApplicationVmwareWorkstationAllAllAllAll
  • cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*:
  • cpe:2.3:o:vmware:esxi:7.0:-:*:*:*:*:*:*:
  • cpe:2.3:o:vmware:esxi:7.0:beta:*:*:*:*:*:*:
  • cpe:2.3:o:vmware:esxi:7.0:update_1:*:*:*:*:*:*:
  • cpe:2.3:o:vmware:esxi:7.0:update_1a:*:*:*:*:*:*:
  • cpe:2.3:o:vmware:esxi:7.0:update_1b:*:*:*:*:*:*:
  • cpe:2.3:o:vmware:esxi:7.0:update_1c:*:*:*:*:*:*:
  • cpe:2.3:o:vmware:esxi:7.0:update_1d:*:*:*:*:*:*:
  • cpe:2.3:o:vmware:esxi:7.0:update_1e:*:*:*:*:*:*:
  • cpe:2.3:o:vmware:esxi:7.0:update_2:*:*:*:*:*:*:
  • cpe:2.3:o:vmware:esxi:7.0:update_2a:*:*:*:*:*:*:
  • cpe:2.3:o:vmware:esxi:7.0:update_2c:*:*:*:*:*:*:
  • cpe:2.3:o:vmware:esxi:7.0:update_2d:*:*:*:*:*:*:
  • cpe:2.3:o:vmware:esxi:7.0:update_2e:*:*:*:*:*:*:
  • cpe:2.3:o:vmware:esxi:7.0:update_3c:*:*:*:*:*:*:
  • cpe:2.3:o:vmware:esxi:7.0:update_3d:*:*:*:*:*:*:
  • cpe:2.3:o:vmware:esxi:7.0:update_3e:*:*:*:*:*:*:
  • cpe:2.3:o:vmware:esxi:7.0:update_3f:*:*:*:*:*:*:
  • cpe:2.3:o:vmware:esxi:7.0:update_3g:*:*:*:*:*:*:
  • cpe:2.3:o:vmware:esxi:8.0:-:*:*:*:*:*:*:
  • cpe:2.3:a:vmware:fusion:*:*:*:*:*:*:*:*:
  • cpe:2.3:a:vmware:workstation:*:*:*:*:*:*:*:*:

Social Mentions

Source Title Posted (UTC)
Twitter Icon @isac_kolej Aktualizacja VMware ESXi, Workstation i Fusion eliminują lukę w zabezpieczeniach (CVE-2022-31705) vmware.com/security/advis… 2022-12-13 21:01:34
Twitter Icon @the_yellow_fall CVE-2022-31705: VMware ESXi, Workstation, and Fusion code execution securityonline.info/cve-2022-31705… #opensource #infosec #security #pentesting 2022-12-14 01:05:41
Twitter Icon @AcooEdi CVE-2022-31705: VMware ESXi, Workstation, and Fusion code execution dlvr.it/SfKQFv via securityonline https://t.co/J7Rcokjl85 2022-12-14 01:12:34
Twitter Icon @piyokango VMSA-2022-0033 (CVE-2022-31705) vmware.com/security/advis… 2022-12-14 01:26:57
Twitter Icon @ohhara_shiojiri "The VM escape flaw, documented as CVE-2022-31705, was exploited by Ant Security researcher Yuhao Jiang on systems… twitter.com/i/web/status/1… 2022-12-14 02:08:02
Twitter Icon @FilipiPires CVE-2022-31705: VMware ESXi, Workstation, and Fusion code execution ift.tt/jzgdeJY #security #opensource… twitter.com/i/web/status/1… 2022-12-14 02:38:49
Twitter Icon @omokazuki SIOSセキュリティブログを更新しました。 VMWareにCriticalの脆弱性(CVE-2022-31702, CVE-2022-31703, CVE-2022-31705)を追記しました。 #cve #sios_tech… twitter.com/i/web/status/1… 2022-12-14 02:50:44
Twitter Icon @sidfm_jp VMware ESXi の USB 2.0 コントローラの処理に VMX プロセスの権限で任意のコードを実行される問題 (CVE-2022-31705 [44401] sid.softek.jp/content/show/4… #SIDfm #脆弱性情報 2022-12-14 05:00:03
Twitter Icon @notegone docs.vmware.com/en/VMware-Work… VMware Workstation 16.2.5 was also released, fixing CVE-2022-31705 / download3.vmware.com/software/WKST-… download 2022-12-14 06:17:23
Twitter Icon @certbe Warning: @VMware issued patches to fix 3 vulnerabilities (CVE-2022-31702, CVE-2022-31703, CVE-2022-31705) in VMwar… twitter.com/i/web/status/1… 2022-12-14 15:07:45
Twitter Icon @lucianot54 "CVE-2022-31705: VMware ESXi, Workstation, and Fusion code execution" via Penetration Testing ift.tt/aYSIGt9 2022-12-14 15:22:01
Twitter Icon @Komodosec #Vulnerability #CVE202231700 CVE-2022-31705: VMware ESXi, Workstation, and Fusion code execution securityonline.info/cve-2022-31705… 2022-12-14 17:50:03
Twitter Icon @SalgueiroMiguel Las vulnerabilidades críticas: • CVE-2022-31705 (CVSS 3.1: 9.3, crítico): vulnerabilidad de escritura fuera de los… twitter.com/i/web/status/1… 2022-12-14 18:29:03
Twitter Icon @SalgueiroMiguel • CVE-2022-31705: Vmware Workstation 16.x-17.x, Vmware ESXI 7.0-8.0 y Vmware Fusion 12.x-13.x • CVE-2022-31702: VMw… twitter.com/i/web/status/1… 2022-12-14 18:29:05
Twitter Icon @CVEreport CVE-2022-31705 : VMware ESXi, Workstation, and Fusion contain a heap out-of-bounds write vulnerability in the USB 2… twitter.com/i/web/status/1… 2022-12-14 19:08:03
Twitter Icon @CSIRT_Telconet Vulnerabilidad en VMware CVE-2022-31705 Afectó a los siguientes productos: VMware ESXi VMware Fusion Pro / Fusion (… twitter.com/i/web/status/1… 2022-12-14 20:14:31
Reddit Logo Icon /r/vmware CVE-2022-31705 2022-12-14 15:53:09
Reddit Logo Icon /r/netcve CVE-2022-31705 2022-12-14 19:47:59
Reddit Logo Icon /r/vmware CVE-2022-31705 vulnerability question, how does it exploit the esxi hosts? 2022-12-15 13:47:00
© CVE.report 2023 Twitter Nitter Twitter Viewer |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

CVE.report and Source URL Uptime Status status.cve.report