CVE-2021-22045: VMware ESXi (7.0, 6.7 before ESXi670-202111101-SG and 6.5 before ESXi650-202110101-SG), VMware Workstation (16.2.0) and VMware Fusion (12.2.0) contains a heap-overflow vulnerability in CD-ROM devic...

Summary

VMware ESXi (7.0, 6.7 before ESXi670-202111101-SG and 6.5 before ESXi650-202110101-SG), VMware Workstation (16.2.0) and VMware Fusion (12.2.0) contains a heap-overflow vulnerability in CD-ROM device emulation. A malicious actor with access to a virtual machine with CD-ROM device emulation may be abl...

What to do

Update vmware workstation to version 16.2.0 or later.
Update vmware fusion to version 12.2.0 or later.

Affected software

Vendor	Product	Affected versions
vmware	cloud_foundation	>= 3.0, <= 3.10.2.2 >= 4.0, <= 4.3.1 `cpe:2.3:a:vmware:cloud_foundation::::::::`
vmware	workstation	>= 16.0.0, < 16.2.0 `cpe:2.3:a:vmware:workstation::::::::`
vmware	fusion	>= 12.0.0, < 12.2.0 `cpe:2.3:a:vmware:fusion::::::::`
vmware	esxi	6.5 6.7 7.0 `cpe:2.3:o:vmware:esxi:6.5:-::::::`

Original advisory text

VMware ESXi (7.0, 6.7 before ESXi670-202111101-SG and 6.5 before ESXi650-202110101-SG), VMware Workstation (16.2.0) and VMware Fusion (12.2.0) contains a heap-overflow vulnerability in CD-ROM devic...

VMware ESXi (7.0, 6.7 before ESXi670-202111101-SG and 6.5 before ESXi650-202110101-SG), VMware Workstation (16.2.0) and VMware Fusion (12.2.0) contains a heap-overflow vulnerability in CD-ROM device emulation. A malicious actor with access to a virtual machine with CD-ROM device emulation may be able to exploit this vulnerability in conjunction with other issues to execute code on the hypervisor from a virtual machine.

References

http://packetstormsecurity.com/files/165440/VMware-Security-Advisory-2022-0001.h... Third Party Advisory VDB Entry
https://www.vmware.com/security/advisories/VMSA-2022-0001.html Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-22-003/ Third Party Advisory VDB Entry