VMware修補單機PC虛擬化軟體的高風險漏洞
· 2024-05-17

本週二VMware發布安裝於x86電腦的Workstation，以及Mac電腦的Fusion更新版本，當中修補4項漏洞，其中有3個是在今年3月舉行的漏洞挖掘競賽Pwn2Own Vancouver 2024揭露

5月14日VMware發布資安公告，指出旗下的虛擬化平臺VMware Workstation、Fusion存在4項漏洞，他們發布VMware Workstation 17.5.2、Fusion 13.5.2予以修補。

這些漏洞當中，最嚴重的是評為重大層級的CVE-2024-22267，從虛擬藍牙裝置元件（vbluetooth）發現，為記憶體釋放後又再存取使用（Use After Free）的漏洞，攻擊者一旦取得本機管理員權限，就有機會對虛擬機器利用這項漏洞，藉由主機上的VMX處理程序，在虛擬機器上執行程式碼，CVSS風險評分為9.3。

另外3個漏洞CVE-2024-22268、CVE-2024-22269、CVE-2024-22270，危險程度皆為高風險層級，其中，CVE-2024-22269、CVE-2024-22270為資訊洩露漏洞，分別存在於虛擬藍牙裝置，以及主機與虛機機器的檔案共用系統（Host Guest File System，HGFS）。至於CVE-2024-22268，則是與Shader的元件有關，為記憶體緩衝區溢位漏洞。而這些漏洞的CVSS風險評分，皆為7.1分。

值得一提的是，以上所有漏洞都是透過趨勢科技旗下的漏洞懸賞專案Zero Day Initiative向VMware通報，除了CVE-2024-22268，其餘皆來自漏洞挖掘競賽Pwn2Own Vancouver 2024，由資安業者Theori、Star Labs SG組成的隊伍發現。

Popular articles
Manila delivers: Highlights from SiGMA Asia 2026 
Southeast Asia
Indiana online casino bill stalls in House committee
Regulation
1spin4win grows its Latin American presence by partnering with Fortuna Juegos
Online Game
Brazil Proposes Raising Gambling Tax Rate to 24%, With Revenue Allocated to Social Security and Healthcare
Regulation
PropellerAds Shared a New iGaming Case Study: 97,674 Installs and 12,701 Deposits in 3 Months
Marketing
Global Game Connect (GGC) 2027 Officially Opens Sponsorship & Exhibition Opportunities in Sri Lanka!
HUIDU Focus
What’s on the SBC Summit Conference Agenda in 2026?
Marketing
Vietnam's tightening online gaming policy creates new market opportunities
Southeast Asia
DB Gaming Is One of Asia’s Top-Tier Game Solution Providers, Recognized as a Pioneer in the Asian Gaming Industry.
Marketing
JILI Partners with Cricket Legend AB de Villiers (ABD) to Launch Exclusive Branded Game Series 100% 11
Sports Game
1spin4win releases unique slot Don Catleone Hold and Win featuring gangster cats
Online Game
Online gambling, crypto pose ongoing money laundering risks in Philippines, analyst says
Southeast Asia
Zenith partners with HUIDU for 2026 World Cup Carnival Official Tour
Online Game
B2B Tech Infrastructure Gains Momentum in Philippine Gaming Sector
Southeast Asia
Are you ready to maximize your earnings? Try ProPush.me Constructor!
Marketing
Home
Game
Cooperation
Find
My