Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-22268
CVE-2024-22268:
NixOS vulnerability analysis and mitigation
Overview
VMware Workstation and Fusion contain a heap buffer-overflow vulnerability (CVE-2024-22268) in the Shader functionality, discovered and disclosed on May 14, 2024. This vulnerability affects VMware Workstation 17.x running on Windows and VMware Fusion 13.x running on OS X (VMware Advisory).
Technical details
The vulnerability is a heap buffer-overflow issue present in the Shader functionality of VMware's virtualization products. It has been assigned a CVSS v3.1 base score of 7.1 (Important) by VMware, with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H. The specific flaw exists within the SVGA virtual device and results from inadequate validation of user-supplied data length before copying it to a heap-based buffer (Zero Day Initiative).
Impact
The exploitation of this vulnerability can lead to a denial of service condition in the affected systems. The vulnerability specifically impacts systems where 3D graphics are enabled on the virtual machine (VMware Advisory).
Mitigation and workarounds
VMware has released patches to address this vulnerability. Users should update to VMware Workstation version 17.5.2 for Windows systems and VMware Fusion version 13.5.2 for OS X systems. Additional workarounds are documented in KB59146 (VMware Advisory).
Community reactions
VMware has acknowledged the contribution of Pwn2car working with Trend Micro Zero Day Initiative for reporting this vulnerability (VMware Advisory).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management