• Home
  • |
  • Blog
  • |
  • How To Fix CVE-2021-22045- Heap Overflow Vulnerability In VMWare Products?
How to Fix CVE-2021-22045- Heap Overflow Vulnerability in VMWare Products

Jaanus Kääp, a security researcher from Clarified Security, reported a Heap Overflow vulnerability in multiple VMWare products. According to the researcher, the CVE-2021-22045 vulnerability could allow an attacker to execute arbitrary code on Hypervisor from a virtual machine. Since the flaw has gained a score of 7.7, which is rated High in CVSS 3.1, it is important to fix the issue on all the affected VMWare products. In this post, let’s see how to fix CVE-2021-22045- Heap Overflow Vulnerability in VMWare Products.

What Is VMWare?

VMWare is now a subsidiary company of Dell Technologies. It is the first company to develop a virtualization platform, which is the core tech behind today’s cloud technologies. It has released a variety of products for desktops, servers, networks, and security, which helped develop virtual and cloud infrastructure.

Summary Of CVE-2021-22045- Heap Overflow Vulnerability In VMWare Products:

This is a Heap Overflow vulnerability that exists within the SCSI component of the CD-ROM device emulator in multiple VMWare products. An attacker should have access to execute low-privileged code on the target guest machine to exploit this vulnerability. So, the exploitation could only be possible for a local attacker. The flaw is due to improper validation of the length of user-supplied data before copying it to a fixed-length heap-based buffer.

Successful exploitation of the vulnerability will let an attacker to escalate privileges and execute arbitrary code on Hypervisor from a virtual machine.

Associated CVE IDCVE-2021-22045
DescriptionHeap Overflow Vulnerability in VMWare Products
Associated ZDI IDZDI-CAN-14237
CVSS Score7.7 High
VectorCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Impact Score6.0
Exploitability Score1.1
Attack Vector (AV)Local
Attack Complexity (AC)High
Privilege Required (PR)Low
User Interaction (UI)None
ScopeChanged
Confidentiality (C)High
Integrity (I)High
availability (a)High

VMware Products Affected With CVE-2021-22045- Heap Overflow Vulnerability:

The flaw affects VMware ESXi, VMware Workstation Pro / Player, VMware Fusion, and VMware Cloud Foundation.

  1. VMware ESXi v6.5, 6.7, and 7.0
  2. VMware Workstation prior to v16.2.0
  3. VMware Fusion prior to v12.2.0

VMware has responded to the flaw with Response Matrix.

ProductVersionRunning OnCVE IdentifierCVSSv3SeverityFixed VersionWorkarounds
ESXi7.0AnyCVE-2021-220457.7ImportantPatch PendingKB87249
ESXi6.7AnyCVE-2021-220457.7ImportantESXi670-202111101-SGKB87249
ESXi6.5AnyCVE-2021-220457.7ImportantESXi650-202110101-SGKB87249
Workstation16.xAnyCVE-2021-220457.7Important16.2.0KB87206
Fusion12.xOS XCVE-2021-220457.7Important12.2.0KB87207
VMware Cloud Foundation (ESXi)4.xAnyCVE-2021-220457.7ImportantPatch PendingKB87249
VMware Cloud Foundation (ESXi)3.xAnyCVE-2021-220457.7ImportantPatch PendingKB87249

How To Fix CVE-2021-22045- Heap Overflow Vulnerability In VMWare Products?

VMWare has released patches to mitigate the vulnerability and published a workaround for the users who can’t apply the patches immediately on the affected VMWare products, the Vendor has recommended disabling all CD/DVD devices on the VMs.

Fix CVE-2021-22045 In VMWare

The best way to fix CVE-2021-22045 is to upgrade the product to the latest release. For ESXi v6.5 & v6.7 users VMWare has released patch. However, users of ESXi v7.x is need to wait for to have the fix.

ESXi VersionFixed VersionBuild Number
6.56.5 P0718678235
6.76.7 P0618828794
7.0PendingPending

Workaround For CVE-2021-22045:

  1. Disable all CD-ROM/DVD devices.
  2. Remove unneeded or unused hardware devices.

Disable All CD-ROM/DVD From The vSphere:

  1. Log in to a vCenter Server system using the vSphere Web Client.
  2. Right-click the virtual machine and click Edit Settings.
  3. Select the CD/DVD drive and uncheck “Connected” and “Connect at power on” and remove any attached ISOs.

Disable all CD-ROM/DVD from Powercli:Powercli can be used to list the virtual machines connected to CD-ROM/DVD and remove the CD-ROM/DVD devices from the VMs.

Command to list all VMs with a connected CD-ROM/DVD device: 

Get-VM | Get-CDDrive | Where {$_.extensiondata.connectable.connected -eq $true} | Select Parent

Command to remove and disconnect an attached CD-ROM/DVD device:

Get-VM | Get-CDDrive | Where {$_.extensiondata.connectable.connected -eq $true} | Set-CDDrive -NoMedia -confirm:$false

Remove Unnecessary Hardware Devices From VMware Workstation:

Select VM > Settings, click the Hardware tab, select the device, and click Remove.

Devices Considered To Remove From Workstation VMs:

  • Virtual hard disks
  • CD-ROM and DVD drives
  • Floppy drives
  • Virtual network adapters
  • USB controllers
  • Sound cards
  • Camera
  • Printers
  • Generic SCSI devices

Remove Unnecessary Hardware Devices From VMware Fusion:

  1. Shut down or power off the virtual machine before changing the device settings.
  2. Select Window (From Mac menu bar)> Virtual Machine Library.
  3. Select a virtual machine in the Virtual Machine Library window and Select VM & click Settings.
  4. Under Removable Devices in the Settings window, Select a device from below list to remove.

Devices Considered To Remove From VM Fusion VMs:

  • Network Adapters
  • Hard Disk
  • Camera
  • CD/DVD
  • Sound Card
  • USB and Bluetooth
  • Serial ports
  • Parallel ports
  • Printer
  • Floppy Drive
  • Trusted Platform Module device

This is how you can fix the heap overflow vulnerability on VMWare products. We hope this post will help you know How to Fix CVE-2021-22045- Heap Overflow Vulnerability in VMWare Products. Thanks for reading this threat post. Please share this post and help to secure the digital world. Visit our social media page on FacebookLinkedInTwitterTelegramTumblr, & Medium and subscribe to receive updates like this. 

About the author

Arun KL

To know more about me. Follow me on LinkedIn Hi All, I am Arun KL, an IT Security Professional. Founder of “thesecmaster.com”. Enthusiast, Security Blogger, Technical Writer, Editor, Author at TheSecMaster. To know more about me. Follow me on LinkedIn

Leave a Reply

Your email address will not be published. Required fields are marked

{"email":"Email address invalid","url":"Website address invalid","required":"Required field missing"}

Learn Something New with Free Email subscription

Email is also one of the ways to be in touch with us. Our free subscription plan offers you to receive post updates straight to your inbox.