CVE-2024-22269 - OpenCVE

VMware Workstation and Fusion contain an information disclosure vulnerability in the vbluetooth device. A malicious actor with local administrative privileges on a virtual machine may be able to read privileged information contained in hypervisor memory from a virtual machine.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24280

History

No history.

MITRE

Status: PUBLISHED

Assigner: vmware

Published: 2024-05-14T12:59:28.869Z

Updated: 2024-08-01T22:43:33.677Z

Reserved: 2024-01-08T18:43:17.079Z

Link: CVE-2024-22269

Vulnrichment

Updated: 2024-08-01T22:43:33.677Z

NVD

Status : Awaiting Analysis

Published: 2024-05-14T16:16:10.117

Modified: 2024-07-03T01:47:12.157

Link: CVE-2024-22269

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-22269", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "state": "PUBLISHED", "assignerShortName": "vmware", "dateReserved": "2024-01-08T18:43:17.079Z", "datePublished": "2024-05-14T12:59:28.869Z", "dateUpdated": "2024-08-01T22:43:33.677Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Windows", "Linux"], "product": "VMware Workstation", "vendor": "N/A", "versions": [{"lessThan": "17.5.2", "status": "affected", "version": "17.x", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "platforms": ["MacOS"], "product": "VMware Fusion", "vendor": "N/A", "versions": [{"lessThan": "13.5.2", "status": "affected", "version": "13.x", "versionType": "custom"}]}], "datePublic": "2024-05-14T04:50:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">VMware Workstation and Fusion contain an information disclosure vulnerability in the vbluetooth device. </span>A malicious actor with local administrative privileges on a virtual machine may be able to read privileged information contained in hypervisor memory from a virtual machine.<span style=\"background-color: rgb(255, 255, 255);\"><br><br></span><br>"}], "value": "VMware Workstation and Fusion contain an information disclosure vulnerability in the vbluetooth device.\u00a0A malicious actor with local administrative privileges on a virtual machine may be able to read privileged information contained in hypervisor memory from a virtual machine.\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"description": "Information disclosure vulnerability", "lang": "en"}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2024-05-14T12:59:28.869Z"}, "references": [{"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24280"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-22269", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-14T14:11:37.404757Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:vmware:vmware_workstation:*:*:*:*:*:*:*:*"], "vendor": "vmware", "product": "vmware_workstation", "versions": [{"status": "affected", "version": "17.0.0"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:vmware:fusion:13.0.0:*:*:*:*:*:*:*"], "vendor": "vmware", "product": "fusion", "versions": [{"status": "affected", "version": "13.0.0"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:52:42.552Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:43:33.677Z"}, "title": "CVE Program Container", "references": [{"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24280", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24280", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:43:33.677Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-22269", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-14T14:11:37.404757Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:vmware:vmware_workstation:*:*:*:*:*:*:*:*"], "vendor": "vmware", "product": "vmware_workstation", "versions": [{"status": "affected", "version": "17.0.0"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:vmware:fusion:13.0.0:*:*:*:*:*:*:*"], "vendor": "vmware", "product": "fusion", "versions": [{"status": "affected", "version": "13.0.0"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-14T14:11:06.793Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "N/A", "product": "VMware Workstation", "versions": [{"status": "affected", "version": "17.x", "lessThan": "17.5.2", "versionType": "custom"}], "platforms": ["Windows", "Linux"], "defaultStatus": "unaffected"}, {"vendor": "N/A", "product": "VMware Fusion", "versions": [{"status": "affected", "version": "13.x", "lessThan": "13.5.2", "versionType": "custom"}], "platforms": ["MacOS"], "defaultStatus": "unaffected"}], "datePublic": "2024-05-14T04:50:00.000Z", "references": [{"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24280"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "VMware Workstation and Fusion contain an information disclosure vulnerability in the vbluetooth device.\u00a0A malicious actor with local administrative privileges on a virtual machine may be able to read privileged information contained in hypervisor memory from a virtual machine.\n\n", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">VMware Workstation and Fusion contain an information disclosure vulnerability in the vbluetooth device. </span>A malicious actor with local administrative privileges on a virtual machine may be able to read privileged information contained in hypervisor memory from a virtual machine.<span style=\"background-color: rgb(255, 255, 255);\"><br><br></span><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Information disclosure vulnerability"}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2024-05-14T12:59:28.869Z"}}}, "cveMetadata": {"cveId": "CVE-2024-22269", "state": "PUBLISHED", "dateUpdated": "2024-08-01T22:43:33.677Z", "dateReserved": "2024-01-08T18:43:17.079Z", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "datePublished": "2024-05-14T12:59:28.869Z", "assignerShortName": "vmware"}, "dataVersion": "5.1"}