CVE-2024-22251 - OpenCVE

VMware Workstation and Fusion contain an out-of-bounds read vulnerability in the USB CCID (chip card interface device). A malicious actor with local administrative privileges on a virtual machine may trigger an out-of-bounds read leading to information disclosure.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://www.vmware.com/security/advisories/VMSA-2024-0005.html

History

Fri, 01 Nov 2024 20:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: vmware

Published: 2024-02-27T17:35:31.786Z

Updated: 2024-11-01T19:23:51.458Z

Reserved: 2024-01-08T18:43:15.942Z

Link: CVE-2024-22251

Vulnrichment

Updated: 2024-08-01T22:43:33.783Z

NVD

Status : Awaiting Analysis

Published: 2024-02-29T01:44:05.870

Modified: 2024-11-01T20:35:05.520

Link: CVE-2024-22251

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-22251", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "state": "PUBLISHED", "assignerShortName": "vmware", "dateReserved": "2024-01-08T18:43:15.942Z", "datePublished": "2024-02-27T17:35:31.786Z", "dateUpdated": "2024-11-01T19:23:51.458Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Windows", "Linux"], "product": "VMware Workstation", "vendor": "n/a", "versions": [{"lessThan": "17.5.1", "status": "affected", "version": "17.x", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "platforms": ["MacOS"], "product": "VMware Fusion", "vendor": "n/a", "versions": [{"lessThan": "13.5.1", "status": "affected", "version": "13.x", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "VMware Workstation and Fusion contain an out-of-bounds read vulnerability in the USB CCID (chip card interface device). <span style=\"background-color: var(--wht);\">A malicious actor with local administrative privileges on a virtual machine may trigger an out-of-bounds read leading to information disclosure.</span><div><div><div><div><div><br></div></div></div></div></div><br>"}], "value": "VMware Workstation and Fusion contain an out-of-bounds read vulnerability in the USB CCID (chip card interface device).\u00a0A malicious actor with local administrative privileges on a virtual machine may trigger an out-of-bounds read leading to information disclosure.\n\n\n\n\n\n\n\n\n\n\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2024-02-27T17:35:31.786Z"}, "references": [{"url": "https://www.vmware.com/security/advisories/VMSA-2024-0005.html"}], "source": {"discovery": "UNKNOWN"}, "title": "Out-of-bounds read vulnerability ", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:43:33.783Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.vmware.com/security/advisories/VMSA-2024-0005.html", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-125", "lang": "en", "description": "CWE-125 Out-of-bounds Read"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-08T19:10:37.257069Z", "id": "CVE-2024-22251", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-01T19:23:51.458Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-22251", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "state": "PUBLISHED", "assignerShortName": "vmware", "dateReserved": "2024-01-08T18:43:15.942Z", "datePublished": "2024-02-27T17:35:31.786Z", "dateUpdated": "2024-11-01T19:23:51.458Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Windows", "Linux"], "product": "VMware Workstation", "vendor": "n/a", "versions": [{"lessThan": "17.5.1", "status": "affected", "version": "17.x", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "platforms": ["MacOS"], "product": "VMware Fusion", "vendor": "n/a", "versions": [{"lessThan": "13.5.1", "status": "affected", "version": "13.x", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "VMware Workstation and Fusion contain an out-of-bounds read vulnerability in the USB CCID (chip card interface device). <span style=\"background-color: var(--wht);\">A malicious actor with local administrative privileges on a virtual machine may trigger an out-of-bounds read leading to information disclosure.</span><div><div><div><div><div><br></div></div></div></div></div><br>"}], "value": "VMware Workstation and Fusion contain an out-of-bounds read vulnerability in the USB CCID (chip card interface device).\u00a0A malicious actor with local administrative privileges on a virtual machine may trigger an out-of-bounds read leading to information disclosure.\n\n\n\n\n\n\n\n\n\n\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2024-02-27T17:35:31.786Z"}, "references": [{"url": "https://www.vmware.com/security/advisories/VMSA-2024-0005.html"}], "source": {"discovery": "UNKNOWN"}, "title": "Out-of-bounds read vulnerability ", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:43:33.783Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.vmware.com/security/advisories/VMSA-2024-0005.html", "tags": ["x_transferred"]}]}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-22251", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-08T19:10:37.257069Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-08T19:10:44.761Z"}}]}}