{"id":14472,"date":"2022-02-17T22:17:55","date_gmt":"2022-02-17T22:17:55","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/02\/17\/vmware-patches-critical-security-vulnerabilities-the-register\/"},"modified":"2022-02-17T22:17:55","modified_gmt":"2022-02-17T22:17:55","slug":"vmware-patches-critical-security-vulnerabilities-the-register","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/02\/17\/vmware-patches-critical-security-vulnerabilities-the-register\/","title":{"rendered":"VMware patches critical security vulnerabilities \u2022 The Register"},"content":{"rendered":"

<\/a>\n<\/p>\n

\n

You’re an IT pro in a VMware shop. A malicious person, for example, gains access to one of your virtual machines via a compromised local admin account for that VM. Can it get worse? Oh yes, VMware has warned \u2013 they can escape onto the host.<\/p>\n

In an advisory this week<\/a> VMware has alerted users to a use-after-free() vulnerability in the XHCI USB controller in ESXi, Workstation, Cloud Foundation and Fusion critical status, with important flaws fixed<\/a> in NSX Data Center as well.<\/p>\n

The five key vulnerabilities were discovered during the Tianfu Cup 2021, a Chinese vulnerability competition, by the country’s Kunlun Lab. Bugs that Kunlun discovered were disclosed privately to VMware \u2013 though last year China passed a new law ordering security researchers to reveal findings<\/a> to the country’s Ministry of Public Security at least two days before anyone else.<\/p>\n

\n