Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.4
VMware ESXi gVisor Vulnerability Allows Unauthorized Access
published 1 year ago
Summary
A security issue in VMware ESXi's gVisor component could allow an attacker to gain unauthorized access to a system, potentially leading to data breaches or other malicious actions. This affects systems running ESXi with gVisor enabled. To mitigate this risk, update your ESXi system to the latest version.
What to do
- Update redhat gvisor-tap-vsock to version 6:0.7.3-5.el9_4.2.
- Update redhat gvisor-tap-vsock-debuginfo to version 6:0.7.3-5.el9_4.2.
- Update redhat gvisor-tap-vsock-debugsource to version 6:0.7.3-5.el9_4.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Red Hat:rhel_eus:9.4::appstream | redhat | gvisor-tap-vsock |
< 6:0.7.3-5.el9_4.2 Fix: upgrade to 6:0.7.3-5.el9_4.2
|
| Red Hat:rhel_eus:9.4::appstream | redhat | gvisor-tap-vsock-debuginfo |
< 6:0.7.3-5.el9_4.2 Fix: upgrade to 6:0.7.3-5.el9_4.2
|
| Red Hat:rhel_eus:9.4::appstream | redhat | gvisor-tap-vsock-debugsource |
< 6:0.7.3-5.el9_4.2 Fix: upgrade to 6:0.7.3-5.el9_4.2
|
Original advisory text
Red Hat Security Advisory: gvisor-tap-vsock security update
References
- https://access.redhat.com/errata/RHSA-2025:8601 Vendor Advisory
- https://access.redhat.com/security/updates/classification/#moderate Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2358493 Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8601.j... Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2025-22871 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2025-22871 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-22871 Vendor Advisory
- https://go.dev/cl/652998 Third Party Advisory
- https://go.dev/issue/71988 Third Party Advisory
- https://groups.google.com/g/golang-announce/c/Y2uBTVKjBQk Third Party Advisory
- https://pkg.go.dev/vuln/GO-2025-3563 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published6 Jun 2025
Updated6 Mar 2026
First seen6 Mar 2026
Sources
RHSA-2025:8601 · OSV
Track software like this
Free during beta