Patch Issued for Critical VMware vCenter Flaw Allowing Remote Code Execution

Broadcom on Tuesday released updates to address a critical security flaw impacting VMware vCenter Server that could pave the way for remote code execution.

The vulnerability, tracked as CVE-2024-38812 (CVSS score: 9.8), has been described as a heap-overflow vulnerability in the DCE/RPC protocol.

"A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution," the virtualization services provider said in a bulletin.

The shortcoming is similar to two other remote code execution flaws, CVE-2024-37079 and CVE-2024-37080 (CVSS scores: 9.8), that VMware resolved in vCenter Server in June 2024.

Also addressed by VMware is a privilege escalation flaw in the vCenter Server (CVE-2024-38813, CVSS score: 7.5) that could enable a malicious actor with network access to the instance to escalate privileges to root by sending a specially crafted network packet.

Security researchers zbl and srs of team TZL have been credited with discovering and reporting the two flaws during the Matrix Cup cybersecurity competition held in China back in June 2024. They have been fixed in the below versions -

• vCenter Server 8.0 (Fixed in 8.0 U3b)
• vCenter Server 7.0 (Fixed in 7.0 U3s)
• VMware Cloud Foundation 5.x (Fixed in 8.0 U3b as an asynchronous patch)
• VMware Cloud Foundation 4.x (Fixed in 7.0 U3s as an asynchronous patch)

Broadcom said it's not aware of malicious exploitation of the two vulnerabilities, but has urged customers to update their installations to the latest versions to safeguard against potential threats.

"These vulnerabilities are memory management and corruption issues which can be used against VMware vCenter services, potentially allowing remote code execution," the company said.

The development comes as the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) released a joint advisory urging organizations to work towards eliminating cross-site scripting (XSS) flaws that threat actors could exploit to breach systems.

"Cross-site scripting vulnerabilities arise when manufacturers fail to properly validate, sanitize, or escape inputs," the government bodies said. "These failures allow threat actors to inject malicious scripts into web applications, exploiting them to manipulate, steal, or misuse data across different contexts."