CVE-2023-20867

Description

A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.

References

https://thehackernews.com/2024/06/chinese-cyber-espionage-group-exploits.html

https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations

https://storage.googleapis.com/gweb-uniblog-publish-prod/documents/Year_in_Review_of_ZeroDays.pdf

https://cloud.google.com/blog/topics/threat-intelligence/2023-zero-day-trends

https://meterpreter.org/cve-2023-34048-inside-the-zero-day-vulnerability-exploited-by-unc3886/

https://www.bleepingcomputer.com/news/security/chinese-hackers-exploit-vmware-bug-as-zero-day-for-two-years/

https://www.vmware.com/security/advisories/VMSA-2023-0013.html

https://www.debian.org/security/2023/dsa-5493

https://security.netapp.com/advisory/ntap-20230725-0001/

https://lists.fedoraproject.org/archives/list/[email protected]/message/ZJM6HDRQYS74JA7YNKQBFH2XSZ52HEWH/

https://lists.fedoraproject.org/archives/list/[email protected]/message/TJNJMD67QIT6LXLKWSHFM47DCLRSMT6W/

https://lists.fedoraproject.org/archives/list/[email protected]/message/NVKQ6Y2JFJRWPFOZUOTFO3H27BK5GGOG/

https://lists.debian.org/debian-lts-announce/2023/08/msg00020.html

http://www.openwall.com/lists/oss-security/2023/10/16/2

http://www.openwall.com/lists/oss-security/2023/10/16/11

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3