VMware Workstation (versions 17.x prior to 17.5) and Fusion (versions 13.x prior to 13.5) are affected by an out-of-bounds read vulnerability that exists in the functionality for sharing host Bluetooth devices with the virtual machine. This post will discuss the details of this vulnerability, including the exploit, its potential impact, and how to address it. We'll also provide code snippets and links to the original references for a better understanding of the issue.

What is CVE-2023-34044?

CVE-2023-34044 is a security vulnerability identifier assigned by the Common Vulnerabilities and Exposures system. The vulnerability in question affects VMware Workstation and Fusion and involves an out-of-bounds read issue in the Bluetooth device-sharing functionality.

Background

To understand this vulnerability, let's first discuss the process of sharing host Bluetooth devices with virtual machines (VMs) in VMware Workstation and Fusion. Both products let users configure virtual machines to access host's Bluetooth devices, such as keyboards, mice, and headsets. This allows the user to use these devices seamlessly with their VMs as if the devices were directly connected to the VM itself.

The vulnerability

The out-of-bounds read vulnerability in VMware Workstation and Fusion occurs when a malicious actor with local administrative privileges on a virtual machine can read privileged information contained in the hypervisor memory from a VM. This is possible due to the improper handling of buffers when processing data from the shared Bluetooth devices.

Here's a simplified code snippet that demonstrates the out-of-bounds read

void read_oob_data(VM *vm, int offset) {
    char buffer[x100];
    int oob_offset = offset + x100;
    memcpy(buffer, vm->bt_device_data + oob_offset, x100);
    // process data
}

In this example, the function reads data from the shared host Bluetooth device beyond the allocated boundary (x100 bytes), resulting in unauthorized access to hypervisor memory. This can potentially leak sensitive information that may lead to further exploitation or compromise of the system.

For more information regarding CVE-2023-34044, please refer to the following resources

- Official VMware Security Advisory
- MITRE CVE Dictionary for CVE-2023-34044
- NVD Detail for CVE-2023-34044

How to fix it

To address this vulnerability, VMware has released patches for the affected products. We highly recommend updating your VMware Workstation to version 17.5 or later and Fusion to version 13.5 or later. Visit VMware's download center to obtain the latest versions:

- VMware Workstation Download Center
- VMware Fusion Download Center

Conclusion

CVE-2023-34044, an out-of-bounds read vulnerability in VMware Workstation and Fusion, highlights the need to ensure software security, especially when sharing devices and resources between host and virtual machines. By updating your VMware Workstation and Fusion installations, you can protect your environment from any potential exploits. Stay informed and take proactive steps to secure your systems!

Timeline

Published on: 10/20/2023 09:15:12 UTC
Last modified on: 10/28/2023 03:34:06 UTC