Hao Zheng

تم اكتشاف ثغرة أمنية في الدالة `amf nsmf pdusession handle update sm context` الموجودة في الملف src/amf/nsmf-handler.c التابع لمكون AMF. تؤدي استغلال هذه الثغرة إلى رفض الخدمة. يمكن شن الهجوم عن بُعد. تسمح هذه المشكلة لجهاز مستخدم واحد (UE) بإسقاط AMF، مما يؤدي إلى فقدان كامل لخدمات إدارة التنقل والجلسات ويسبب انقطاعًا في الشبكة بأكملها. ستفقد جميع أجهزة المستخدمين المسجلة الاتصال وسيتم حظر التسجيلات الجديدة حتى يتم إعادة تشغيل AMF، مما يؤثر على التوافر العالي.

تم تحديد ثغرة أمنية من نوع «رفض الخدمة» في الدالة `gmm state authentication` الموجودة في الملف `src/amf/gmm-sm.c` في مكون AMF. يمكن استغلال هذه الثغرة أمنية عن بُعد، مما يؤدي إلى انقطاع في الشبكة بأكملها، ويسبب فقدان الاتصال لجميع أجهزة المستخدمين (UEs) المسجلة، ويحظر عمليات التسجيل الجديدة حتى يتم إعادة تشغيل AMF. وقد تم الكشف عن طريقة الاستغلال هذه علنًا ويمكن استخدامها.

Name of the Vulnerable Software and Affected Versions: VMware ESXi (affected versions not specified) Description: The issue is related to an out-of-bounds read, which can be triggered by a malicious actor with local administrative privileges on a virtual machine that has an existing snapshot. This can lead to a denial-of-service condition of the host. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

VMware vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. This out-of-bounds write flaw allows a malicious actor with network access to trigger the vulnerability by sending a specially crafted network packet, potentially leading to remote code execution. The vulnerability is actively being exploited in the wild, and CISA has added it to its Known Exploited Vulnerabilities Catalog. Successful exploitation can enable broad takeover and lateral movement across an organization’s virtual infrastructure. The vulnerability is rated with a CVSS score of 9.8, indicating critical severity.

The issue is a heap-overflow vulnerability in the implementation of the DCERPC protocol within VMware vCenter Server. A malicious actor with network access can trigger this by sending a specially crafted network packet, potentially leading to remote code execution. The vulnerability is due to improper memory handling during the processing of DCERPC protocol requests. The DCERPC protocol is a remote procedure call mechanism used for communication between different components of the vCenter Server. Exploitation allows an unauthenticated attacker to execute arbitrary code on the server.

The storage controllers on VMware ESXi, Workstation, and Fusion have an out-of-bounds read/write issue. A malicious actor with access to a virtual machine with storage controllers enabled may exploit this issue to create a denial of service condition or execute code on the hypervisor from a virtual machine in conjunction with other issues.

A use-after-free vulnerability in the XHCI USB controller of VMware products allows a malicious actor with local administrative privileges on a virtual machine to execute code as the virtual machine's VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox, whereas on Workstation and Fusion, this may lead to code execution on the machine where Workstation or Fusion is installed.

The issue is related to an information disclosure vulnerability in the UHCI USB controller of the affected software. A malicious actor with administrative access to a virtual machine may be able to exploit this issue to leak memory from the vmx process. This vulnerability is associated with a lack of protection for service data, which could allow an attacker to disclose protected information.

The issue is related to an out-of-bounds read vulnerability in the USB CCID (chip card interface device) of VMware Workstation and Fusion. A malicious actor with local administrative privileges on a virtual machine may trigger an out-of-bounds read, leading to information disclosure.