VMware has identified three vulnerabilities in its Virtual Machine Communication Interface, with severity ratings ranging from 7.1 to 9.3. Key concerns arise from the possibility that local access may not be necessary for an attacker if they can access any VM in a compromised hosting environment, potentially putting all VMs at risk. Experts warn that even a single poorly secured VM can jeopardize the entire hypervisor. Organizations using affected products are urged to investigate and secure their networks against these vulnerabilities, which have been recognized by U.S. cybersecurity authorities.
All three vulnerabilities were reported to Broadcom by Microsoft Threat Intelligence Center. The US Cybersecurity and Infrastructure Security Agency has already added all three to its list of Known Exploited Vulnerabilities.
Given hypervisors will often have multiple customers/projects/security zones on, this class of vulnerability is very bad news. A customer doing a bad job of securing just one VM puts every other VM on that hypervisor at risk.
Collection
[
|
...
]