Broadcom Releases New Versions to Fix Security Vulnerabilities

TapTechNews May 19th news, Broadcom recently released a security bulletin and announced the launch of MwareWorkstation 17.5.2 and Fusion 13.5.2 versions, mainly fixing four security vulnerabilities.

Among these vulnerabilities, the most serious one is CVE-2024-22267 rated as critical, and the CVSS risk score of this vulnerability is 9.3. This is a UseAfterFree type RAM vulnerability in the virtual Bluetooth device component (vbluetooth) (TapTechNews note: After a certain part of RAM is released, the program continues to use the released RAM area). Once a hacker obtains local administrator rights, they can use this vulnerability to execute malicious code on the virtual machine through the VMX process.

The CVSS scores of the other three vulnerabilities are all 7.1 high risk, namely CVE-2024-22268, CVE-2024-22269, and CVE-2024-22270.

Among them, CVE-2024-22269 and CVE-2024-22270 are information leakage vulnerabilities located in the virtual Bluetooth device and the file sharing system of the host/virtual machine (HostGuestFileSystem, HGFS) respectively. And CVE-2024-22268 is related to the Shader component, which is a memory buffer overflow vulnerability.

Except for CVE-2024-22268, the other three vulnerabilities all come from the Bug Hunting Contest Pwn2OwnVancouver2024, discovered by the team composed of the security company Theori and StarLabsSG, and the CVE-2024-22268 vulnerability comes from the Bounty Program ZeroDayInitiative.