Pierluigi Paganini March 05, 2025

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Linux kernel and VMware ESXi and Workstation flaws to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog:

• CVE-2024-50302 Linux Kernel Use of Uninitialized Resource Vulnerability
• CVE-2025-22225 VMware ESXi Arbitrary Write Vulnerability
• CVE-2025-22224 VMware ESXi and Workstation TOCTOU Race Condition Vulnerability
• CVE-2025-22226 VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability

The first issue, tracked as CVE-2024-50302, was addressed by Google with the release of the Android March 2025 security update.

CVE-2024-50302 (CVSS score of 5.5) is a Linux kernel vulnerability that was fixed by zero-initializing the HID report buffer during allocation to prevent potential kernel memory leaks. 

Google did now share details about the attacks exploiting the above vulnerabilities, however, in 2024, the Security Lab provided evidence of a Cellebrite zero-day exploit chain to industry partners, leading Google to identify three vulnerabilities. CVE-2024-53104 was patched in Android’s February 2025 update, while CVE-2024-53197 and CVE-2024-50302 (CVSS score of 5.5) were patched in the Linux kernel but not yet in Android.

Amnesty International revealed that the vulnerability CVE-2024-50302 was likely used by Cellebrite’s mobile forensic tools to unlock the Android phone of a Serbian student activist.

This week, Broadcom released security updates to address three VMware zero-day vulnerabilities in ESX products that are actively exploited in the wild.

The flaws, respectively tracked as CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226, impact multiple VMware ESX products, including VMware ESXi, vSphere, Workstation, Fusion, Cloud Foundation, and Telco Cloud Platform.

Researchers from Microsoft Threat Intelligence Center discovered the three vulnerabilities.

An attacker with privileged administrator or root access can chain the vulnerabilities to escape the sandbox within the virtual machine.

Below are the descriptions for these vulnerabilities:

• CVE-2025-22224 (CVSS score of 9.3) VMCI heap-overflow vulnerability: the vulnerability is TOCTOU (Time-of-Check Time-of-Use) issue in VMware ESXi, and Workstation that can lead to an out-of-bounds write. “A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine’s VMX process running on the host.” reads the advisory. 
• CVE-2025-22225 (CVSS score of 8.2) VMware ESXi arbitrary write vulnerability: the vulnerability is an arbitrary write issue in VMware ESXi. An attackers with privileges within the VMX process may trigger an arbitrary kernel write leading to an escape of the sandbox.
• CVE-2025-22226 (CVSS score of 7.1) HGFS information-disclosure vulnerability: the vulnerability is an information disclosure vulnerability that impacts VMware ESXi, Workstation, and Fusion. The vulnerability is due to an out-of-bounds read in HGFS. An attacker with administrative privileges to a virtual machine may be able to exploit this issue to leak memory from the vmx process. 

The virtualization giant confirmed that it has information to suggest that exploitation of the three flaws has occurred in the wild.

“On March 4, 2025 Broadcom released a critical VMware Security Advisory (VMSA), VMSA-2025-0004, addressing security vulnerabilities found and resolved in VMware ESX regarding a mechanism where threat actors could access the hypervisor through a running virtual machine” states the company. “Are the vulnerabilities being exploited “in the wild?” Broadcom has information to suggest that exploitation of these issues has occurred “in the wild.” “Is this a “VM Escape?” “Yes. This is a situation where an attacker who has already compromised a virtual machine’s guest OS and gained privileged access (administrator or root) could move into the hypervisor itself.”

The company has not disclosed specific details about the attacks or the threat actors behind them.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix this vulnerability by March 25, 2025.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)