VMware vCenter Server contains critical out-of-bounds write vulnerability
CVE-2023-34048

9.8CRITICAL

Key Information:

Vendor
Vmware
Status
Vmware Vcenter Server
Vmware Cloud Foundation (vmware Vcenter Server)
Vendor
CVE Published:
25 October 2023

Badges

📈 Trended💰 Ransomware👾 Exploit Exists🟣 EPSS 42%🦅 CISA Reported📰 News Worthy

What is CVE-2023-34048?

CVE-2023-34048 is a critical vulnerability found in VMware vCenter Server, an essential product used for managing virtualized environments and infrastructure. This vulnerability pertains to an out-of-bounds write in the DCERPC protocol implementation. If successfully exploited, this flaw could allow attackers who have network access to the vCenter Server to execute malicious code remotely, leading to severe consequences for organizations that rely on this software for their virtual management needs.

Technical Details

The vulnerability is categorized as an out-of-bounds write issue, which occurs when a program writes data outside the boundaries of allocated memory. In the case of CVE-2023-34048, the flaw exists within the DCERPC protocol in VMware vCenter Server. By leveraging this weakness, attackers can manipulate how memory is managed, potentially gaining control over the server's execution environment. This could lead to unauthorized actions without the user's consent, highlighting the critical nature of this vulnerability.

Potential Impact of CVE-2023-34048

  1. Remote Code Execution: If exploited, the vulnerability can enable attackers to execute arbitrary code on the vCenter Server, giving them extensive control over the server’s operations and the virtual machines it manages.

  2. Data Breaches: Successful exploitation may lead to access to sensitive data managed within the virtualized environment. This could result in significant data leaks and compromise the confidentiality of organizational information.

  3. Increased Ransomware Risks: The vulnerability has been identified as actively exploited in the wild, including by ransomware groups. This escalation in active threats can lead to ransomware attacks, which may cripple an organization's operational capabilities and demand hefty ransoms for data recovery.

CISA Reported

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace as recent news articles suggest the vulnerability is being used by ransomware groups.

The CISA's recommendation is: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Affected Version(s)

VMware Cloud Foundation (VMware vCenter Server) Linux 5.x

VMware Cloud Foundation (VMware vCenter Server) Linux 4.x

VMware vCenter Server Linux 8.0 < 8.0U2

News Articles

favicon imageThe Stack

VMware critical RCE vulnerability in vCenter Server identified in $2.5 million Chinese zero day competition

There is no workaround for the critical CVE, which is one of a pair of bugs which let attackers carry out remote code execution or escalate privileges.

4 months ago

favicon imageSC Media

Prolonged exploitation of VMware zero-day conducted by Chinese hackers

Attacks exploiting a critical out-of-bounds write zero-day vulnerability in VMware Center Server, tracked as CVE-2023-34048, have been deployed by Chinese cyberespionage operation UNC3886 since 2021, two years before the flaw was identified and addressed, reports The Hacker News.

5 months ago

favicon imageTheCyberThrone

CISA adds VMware bug CVE-2023-34048 to its catalog

The U.S. CISA has added a VMware vCenter Server Out-of-Bounds Write bug, tracked as CVE-2023-34048, to its Known Exploited Vulnerabilities (KEV) catalog. In October 2023, VMware addressed the flaw CVE-2023-34048 with a CVSS score 9.8. On January 18, 2024, revealing that it is aware of exploitation “...

1 year ago

References

https://www.vmware.com/security/advisories/VMSA-2023-0023...

EPSS Score

42% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🦅

    CISA Reported

  • 💰

    Used in Ransomware

  • 📈

    Vulnerability started trending

  • 👾

    Exploit known to exist

  • 📰

    First article discovered by SystemTek

  • Vulnerability published

  • Vulnerability Reserved

.