Article Details
Scrape Timestamp (UTC): 2025-03-04 13:25:29.895
Original Article Text
Click to Toggle View
Broadcom fixes three VMware zero-days exploited in attacks. Broadcom warned customers today about three VMware zero-days, tagged as exploited in attacks and reported by the Microsoft Threat Intelligence Center. The vulnerabilities (CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226) impact VMware ESX products, including VMware ESXi, vSphere, Workstation, Fusion, Cloud Foundation, and Telco Cloud Platform. Attackers with privileged administrator or root access can chain these flaws to escape the virtual machine's sandbox. "This is a situation where an attacker who has already compromised a virtual machine's guest OS and gained privileged access (administrator or root) could move into the hypervisor itself," the company explained today. "Broadcom has information to suggest that exploitation of these issues has occurred 'in the wild'." Broadcom says CVE-2025-22224 is a critical-severity VCMI heap overflow vulnerability that enables local attackers with administrative privileges on the targeted VM to execute code as the VMX process running on the host. CVE-2025-22225 is an ESXi arbitrary write vulnerability that allows the VMX process to trigger arbitrary kernel writes, leading to a sandbox escape, while CVE-2025-22226 is described as an HGFS information-disclosure flaw that lets threat actors with admin permissions to leak memory from the VMX process. A Microsoft spokesperson was not immediately available to comment when contacted by BleepingComputer earlier today for more information on these three zero days. VMware vulnerabilities are often targeted in attacks by ransomware gangs and state-sponsored hacking groups because they are commonly used in enterprise operations to store or transfer sensitive corporate data. Most recently, Broadcom warned in November that attackers were actively exploiting two VMware vCenter Server vulnerabilities that were patched in September. One allows privilege escalation to root (CVE-2024-38813) while the other is a critical remote code execution flaw (CVE-2024-38812) reported during China's 2024 Matrix Cup hacking contest. In January 20204, Broadcom also revealed that Chinese state hackers had exploited a critical vCenter Server vulnerability (CVE-2023-34048) as a zero-day since at least late 2021 to deploy VirtualPita and VirtualPie backdoors on vulnerable ESXi hosts.
Daily Brief Summary
Broadcom announced the discovery of three exploited VMware zero-days, raising concerns in the cybersecurity community.
Identified vulnerabilities impact several VMware products, including ESXi, vSphere, and Cloud Foundation, potentially affecting a wide range of enterprise operations.
Attackers leveraging these flaws can escalate from a compromised virtual machine to the host system, increasing the potential for significant breaches.
One of the flaws, a VCMI heap overflow, allows code execution on the host, while another facilitates arbitrary kernel writes, both critical for sandbox escapes.
Microsoft's Threat Intelligence Center initially reported the zero-days being actively exploited in the wild.
VMware products are frequently targeted by both ransomware groups and nation-state actors due to their prevalence in managing sensitive data.
Recent history shows a pattern of recurrent VMware vulnerabilities being exploited, including two significant exploits patched last September.
Broadcom had previously reported exploitation of VMware vulnerabilities by Chinese state hackers, demonstrating the ongoing importance of securing these environments from cyber threats.