Pierluigi Paganini
March 05, 2025
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog:
The first issue, tracked as CVE-2024-50302, was addressed by Google with the release of the Android March 2025 security update.
CVE-2024-50302 (CVSS score of 5.5) is a Linux kernel vulnerability that was fixed by zero-initializing the HID report buffer during allocation to prevent potential kernel memory leaks.
Google did now share details about the attacks exploiting the above vulnerabilities, however, in 2024, the Security Lab provided evidence of a Cellebrite zero-day exploit chain to industry partners, leading Google to identify three vulnerabilities. CVE-2024-53104 was patched in Android’s February 2025 update, while CVE-2024-53197 and CVE-2024-50302 (CVSS score of 5.5) were patched in the Linux kernel but not yet in Android.
Amnesty International revealed that the vulnerability CVE-2024-50302 was likely used by Cellebrite’s mobile forensic tools to unlock the Android phone of a Serbian student activist.
This week, Broadcom released security updates to address three VMware zero-day vulnerabilities in ESX products that are actively exploited in the wild.
The flaws, respectively tracked as CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226, impact multiple VMware ESX products, including VMware ESXi, vSphere, Workstation, Fusion, Cloud Foundation, and Telco Cloud Platform.
Researchers from Microsoft Threat Intelligence Center discovered the three vulnerabilities.
An attacker with privileged administrator or root access can chain the vulnerabilities to escape the sandbox within the virtual machine.
Below are the descriptions for these vulnerabilities:
The virtualization giant confirmed that it has information to suggest that exploitation of the three flaws has occurred in the wild.
“On March 4, 2025 Broadcom released a critical VMware Security Advisory (VMSA), VMSA-2025-0004, addressing security vulnerabilities found and resolved in VMware ESX regarding a mechanism where threat actors could access the hypervisor through a running virtual machine” states the company. “Are the vulnerabilities being exploited “in the wild?” Broadcom has information to suggest that exploitation of these issues has occurred “in the wild.” “Is this a “VM Escape?” “Yes. This is a situation where an attacker who has already compromised a virtual machine’s guest OS and gained privileged access (administrator or root) could move into the hypervisor itself.”
The company has not disclosed specific details about the attacks or the threat actors behind them.
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
CISA orders federal agencies to fix this vulnerability by March 25, 2025.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CISA)
