Partially Unpatched VMware Bug Opens Door to Hypervisor Takeover

Reading Time: 2 Minutes

The issue affects a wide swath of the virtualization specialist’s portfolio and affects Windows, Linux and Mac users. Details about the platforms:

• Cloud Foundation is VMware’s multicloud management platform, providing software-defined services for compute, storage, network, security, Kubernetes and so on.
• ESXi is a bare-metal hypervisor that installs on a server and partitions it into multiple virtual machines (VMs).
• Fusion is a software hypervisor that allows Intel-based Macs to run VMs with guest operating systems – such as Microsoft Windows, Linux, NetWare, Solaris or macOS.
• Workstation enables users to set up VMs on a single physical machine.

The bug (CVE-2021-22045) is a high-severity heap-overflow vulnerability carrying a CVSS rating of 7.7 out of 10. Heap overflows are memory issues that can result in data corruption or unexpected behavior by any process that accesses the affected memory area – in some cases resulting in remote code execution (RCE).

In this case, the problem specifically exists in the CD-ROM device emulation function of the affected products.

“A malicious actor with access to a virtual machine with CD-ROM device emulation may be able to exploit this vulnerability in conjunction with other issues, to execute code on the hypervisor from a virtual machine,” the vendor noted in its advisory. “Successful exploitation requires a CD image to be attached to the virtual machine.”

Reno Robert, senior vulnerability researcher for Trend Micro’s Zero Day Initiative, told Threatpost that the issue results from “the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer.”

Complex but Dangerous Exploitation

Robert added that even though the bug allows an untrusted guest OS user to execute code on the hypervisor, “an attacker would not have control over the data written, so exploitation this would be difficult.”

Hence the need to be used “in conjunction with other issues.” Reno explained that an example of other issues “could be an information-disclosure vulnerability that provide details on the memory layout. This would making exploitation more feasible.”

If successful though, attackers could compromise the host operating system of the hypervisor. Taking over a hypervisor, which is the highly privileged software that creates and runs VMs and governs how resources are shared among them (such as memory and processing), can give cybercriminals a clear path to accessing any of the data or applications stored in the VMs it controls, and executing code or installing files on those VMs, depending on the security controls that are implemented.

Researcher “Jaanus K\xc3\xa4\xc3\xa4p” with Clarified Security and Trend Micro’s ZDI were credited with discovering the bug.

See Also: Offensive Security Tool: Spray365

Workaround for ESXi v.7 Users

Of course, all of that is bad news for ESXi v.7 users, who don’t yet have a patch for this latest bug. VMware did, however, issue a workaround that can be used for now, involving disabling CD-ROM/DVD functionality.

The steps are:

1. Log in to a vCenter Server system using the vSphere Web Client.
2. Right-click the virtual machine and click Edit Settings.
3. Select the CD/DVD drive and uncheck “Connected” and “Connect at power on” and remove any attached ISOs.

See Also: Hacking stories – Rafael Núñez (aka RaFa), hacking NASA with the hacking group: World of Hell

To enumerate the VMs that have a CD-ROM/DVD device attached, users can run the following command, according to the vendor:

Get-VM | Get-CDDrive | Where {$_.extensiondata.connectable.connected -eq $true} | Select Parent

Then the following command will remove and disconnect the attached CD-ROM/DVD device:

Get-VM | Get-CDDrive | Where {$_.extensiondata.connectable.connected -eq $true} | Set-CDDrive -NoMedia -confirm:$false

Source: threatpost.com

(Click Link)