CVE-2024-22255: VMware ESXi Information Disclosure Flaw

CVE-2024-22255 Overview

CVE-2024-22255 is an information disclosure vulnerability affecting VMware ESXi, Workstation, and Fusion products. The vulnerability exists within the Universal Host Controller Interface (UHCI) USB controller emulation, which is used to provide USB functionality to virtual machines. A malicious actor with administrative access to a virtual machine may be able to exploit this issue to leak memory from the vmx process, potentially exposing sensitive information from the hypervisor's memory space.

The vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling), indicating improper resource management in the UHCI USB controller implementation that enables unauthorized memory access.

Critical Impact

This vulnerability allows attackers with VM administrative access to leak sensitive memory contents from the VMX (Virtual Machine Executable) process, potentially exposing credentials, encryption keys, or other confidential data from the hypervisor layer.

Affected Products

• VMware ESXi 7.0 (all updates through Update 3o)
• VMware ESXi 8.0 (through Update 2)
• VMware Workstation (affected versions)
• VMware Fusion (affected versions on macOS)
• VMware Cloud Foundation

Discovery Timeline

• March 5, 2024 - CVE-2024-22255 published to NVD
• May 7, 2025 - Last updated in NVD database

Technical Details for CVE-2024-22255

Vulnerability Analysis

The vulnerability resides in the UHCI (Universal Host Controller Interface) USB controller emulation layer within VMware's virtualization products. The UHCI controller is responsible for managing USB 1.x device communication between guest operating systems and the underlying hypervisor.

The root issue involves improper memory handling during USB controller operations. When certain operations are performed through the emulated UHCI controller, the vmx process fails to properly sanitize or restrict memory allocations, allowing an attacker to read memory contents that should be inaccessible to the guest VM.

The attack requires local access and administrative privileges within the virtual machine. While this limits the attack surface, it represents a significant concern in multi-tenant cloud environments where VM escape or host compromise scenarios could lead to broader infrastructure exposure.

Root Cause

The vulnerability stems from CWE-770: Allocation of Resources Without Limits or Throttling. The UHCI USB controller implementation does not properly enforce boundaries when allocating and accessing memory resources. This allows the vmx process—which handles virtual machine execution on the host—to inadvertently expose memory contents to privileged users within the guest operating system.

The vmx process runs with elevated privileges on the hypervisor and has access to sensitive host memory regions. The improper memory handling in the UHCI controller creates a side channel through which portions of this memory can be read by an attacker with administrative access to the guest VM.

Attack Vector

The attack requires local access to a virtual machine with administrative privileges. An attacker would need to:

1. Gain administrative access to a target virtual machine running on VMware ESXi, Workstation, or Fusion
2. Interact with the emulated UHCI USB controller through specific operations that trigger the memory leak
3. Extract and analyze the leaked memory contents from the vmx process

The vulnerability is particularly concerning in environments where:

• Virtual machines are shared among multiple tenants
• Sensitive workloads run alongside less trusted VMs
• Administrative credentials for VMs may be compromised through other means

The vulnerability can be exploited by crafting specific requests to the UHCI USB controller that cause improper memory access patterns. The technical details of exploitation involve manipulating USB device enumeration and data transfer operations to trigger memory disclosure from the vmx process. See the VMware Security Advisory VMSA-2024-0006 for additional technical details.

Detection Methods for CVE-2024-22255

Indicators of Compromise

• Unusual USB controller activity or enumeration patterns within virtual machines
• Abnormal memory access patterns in vmx process logs
• Unexpected USB device connection/disconnection events in VM logs
• Elevated privilege escalation attempts within guest VMs targeting USB subsystems

Detection Strategies

• Monitor vmx process behavior for anomalous memory access patterns or unexpected memory allocation sizes
• Implement logging and alerting for administrative access to virtual machine USB controller configurations
• Deploy endpoint detection on ESXi hosts to identify suspicious vmx process activity
• Audit VM configurations for USB controller passthrough settings and unnecessary USB device access

Monitoring Recommendations

• Enable verbose logging for USB controller operations on ESXi hosts
• Monitor for bulk USB data transfer operations that may indicate exploitation attempts
• Implement network segmentation to limit lateral movement from potentially compromised VMs
• Review and audit administrative access to virtual machines regularly

How to Mitigate CVE-2024-22255

Immediate Actions Required

• Apply VMware security patches referenced in VMSA-2024-0006 immediately
• Disable USB controllers for virtual machines that do not require USB functionality
• Review and restrict administrative access to virtual machines to minimize attack surface
• Consider migrating critical workloads to patched hypervisor versions

Patch Information

VMware has released security updates addressing this vulnerability. Administrators should consult the VMware Security Advisory VMSA-2024-0006 for specific patch versions and download links for affected products.

For VMware ESXi, updates are available for both the 7.0 and 8.0 branches. VMware Workstation and Fusion users should update to the latest available versions that address this vulnerability.

Workarounds

• Remove or disable USB controllers from virtual machine configurations where USB functionality is not required
• Restrict administrative access to virtual machines using role-based access controls
• Implement network isolation for virtual machines to limit post-exploitation impact
• Consider using alternative USB controller types (xHCI) if available and not affected

# Disable USB controller for a VM via VMware CLI (PowerCLI example)
# List VMs with USB controllers
Get-VM | Get-USBDevice

# Remove USB controller from VM configuration (requires VM power off)
# In VM settings, remove the USB Controller device
# Or modify the .vmx file to remove usb.present = "TRUE"