CISA bu açığın gerçek saldırılarda kullanıldığını 04.03.2025 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 25.03.2025.
Gerekli işlem: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390 ; https://nvd.nist.gov/vuln/detail/CVE-2025-22225
VMware ESXi contains an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may trigger an arbitrary kernel write leading to an escape of the sandbox.
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| — | VMware Cloud Foundation | 5.x, 4.5.x | |
| — | VMware ESXi | 8.0 – < ESXi80U3d-24585383, 8.0 – < ESXi80U2d-24585300, 7.0 – < ESXi70U3s-24585291 | |
| — | VMware Telco Cloud Infrastructure | 3.x, 2.x | |
| — | VMware Telco Cloud Platform | 5.x, 4.x, 3.x, 2.x | |
| vmware | cloud foundation | — | |
| vmware | esxi | 7.0 | |
| vmware | telco cloud infrastructure | 2.2 | |
| vmware | telco cloud platform | 2.0 |
cpe:2.3:o:vmware:esxi:7.0:-:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:7.0:beta:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:7.0:update_1:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:7.0:update_1a:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:7.0:update_1b:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:7.0:update_1c:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:7.0:update_1d:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:7.0:update_1e:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:7.0:update_2:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:7.0:update_2a:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:7.0:update_2c:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:7.0:update_2d:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:7.0:update_2e:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:7.0:update_3:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:7.0:update_3c:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:7.0:update_3d:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:7.0:update_3e:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:7.0:update_3f:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:7.0:update_3g:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:7.0:update_3i:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:7.0:update_3j:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:7.0:update_3k:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:7.0:update_3l:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:7.0:update_3m:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:7.0:update_3n:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:7.0:update_3o:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:7.0:update_3p:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:7.0:update_3q:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:7.0:update_3r:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:8.0:-:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:8.0:a:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:8.0:b:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:8.0:c:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:8.0:update_1:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:8.0:update_1a:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:8.0:update_1c:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:8.0:update_1d:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:8.0:update_2:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:8.0:update_2b:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:8.0:update_2c:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:8.0:update_3:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:8.0:update_3b:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:8.0:update_3c:*:*:*:*:*:*cpe:2.3:a:vmware:cloud_foundation:-:*:*:*:*:*:*:*cpe:2.3:a:vmware:telco_cloud_infrastructure:2.2:*:*:*:*:*:*:*cpe:2.3:a:vmware:telco_cloud_infrastructure:2.5:*:*:*:*:*:*:*cpe:2.3:a:vmware:telco_cloud_infrastructure:2.7:*:*:*:*:*:*:*cpe:2.3:a:vmware:telco_cloud_infrastructure:3.0:*:*:*:*:*:*:*cpe:2.3:a:vmware:telco_cloud_platform:2.0:*:*:*:*:*:*:*cpe:2.3:a:vmware:telco_cloud_platform:2.5:*:*:*:*:*:*:*cpe:2.3:a:vmware:telco_cloud_platform:2.7:*:*:*:*:*:*:*cpe:2.3:a:vmware:telco_cloud_platform:3.0:*:*:*:*:*:*:*cpe:2.3:a:vmware:telco_cloud_platform:4.0:*:*:*:*:*:*:*cpe:2.3:a:vmware:telco_cloud_platform:4.0.1:*:*:*:*:*:*:*cpe:2.3:a:vmware:telco_cloud_platform:5.0:*:*:*:*:*:*:*Ücretsiz ve açık kaynak honeypot sensörümüz, sunucunuzun kullanmadığı portlarda bekler; bağlanan tarayıcıları ve saldırganları ortak kara listeye bildirir.