This critical flaw in VMware’s VMCI (Virtual Machine Communication Interface) allows attackers with local administrative privileges on a virtual machine to execute code on the underlying host. VMware has issued a critical security advisory (VMSA-2025-0004) warning of active exploitation of three vulnerabilities in its ESXi, Workstation, and Fusion products. In July 2024, ransomware groups like Akira and Black Basta exploited CVE-2024-37085, an authentication bypass flaw affecting 20,000+ internet-exposed ESXi servers, to encrypt hypervisors and hosted VMs. With ransomware groups and nation-state actors increasingly targeting hypervisors, organizations must prioritize patch cycles and adopt proactive security measures, including network segmentation and credential hardening. This vulnerability (CVSS 7.1) in VMware’s Host-Guest File System (HGFS) allows attackers with VM admin rights to leak memory from the host’s vmx process. These flaws, CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226, allow attackers to execute malicious code, escalate privileges, and leak sensitive memory data. Rated “Important” (CVSS 8.2), this flaw permits attackers with VMX process privileges to write arbitrary kernel data, bypassing sandbox protections. The most severe vulnerability, CVE-2025-22224, carries a CVSSv3 score of 9.3 and enables hypervisor-level code execution from a compromised virtual machine. Similarly, the 2022 VMSA-2022-0004 advisory addressed a virtual USB controller flaw enabling VM escapes, underscoring persistent risks in virtualization environments. The Shadowserver Foundation observed over 20,000 internet-facing ESXi instances vulnerable to CVE-2024-37085 as of July 2024, a precursor to the current wave of exploits. VMware confirmed active exploitation in the wild, and Microsoft Threat Intelligence Center was credited with discovering it. VMware notes this vulnerability has also been exploited, though it requires prior access to the VMX environment.
This Cyber News was published on cybersecuritynews.com. Publication date: Tue, 04 Mar 2025 12:00:03 +0000