CVE-2024-38812criticalunder attackCWE-122

CVE-2024-38812: critical vulnerability in VMware Cloud Foundation

Heap-overflow vulnerability

Published · Updated

Follow this CVE+ Monitor VMware Cloud Foundation+ Monitor vCenter Server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

70Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has an official Brazilian government alert.

ssvc Actcvss 9.8epss 55%
from disclosure to weapon
Published on NVDSep 17
CISA KEV+64d
Official alert in Brazil

Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.

  • CTIR Gov · ALERTA 21/2024Vulnerabilidades críticas na plataforma VMware vCenter Serverread on gov.br ↗
Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.
Action required by CISAfederal deadline: 2024-12-11

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

vCenter Server has a memory overflow flaw in how it handles network communications that allows attackers to crash the system or run malicious code by sending specially crafted packets over the network.

Technical detail

A heap buffer overflow exists in the DCERPC protocol handler of vCenter Server; remote unauthenticated attackers can exploit this via crafted network packets to achieve arbitrary code execution with the privileges of the vCenter process.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · VMware Cloud Foundationn/a · VMware vCenter Server