VMware ESXi Memory Corruption via Unsynced Signed VM Image
CVE-2023-33119 Published on May 6, 2024

Time-of-check Time-of-use (TOCTOU) Race Condition in Hypervisor
Memory corruption while loading a VM from a signed VM image that is not coherent in the processor cache.

NVD

Vulnerability Analysis

CVE-2023-33119 can be exploited with local system access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.

Attack Vector:

LOCAL

Attack Complexity:

LOW

Privileges Required:

NONE

User Interaction:

NONE

Scope:

UNCHANGED

Confidentiality Impact:

HIGH

Integrity Impact:

HIGH

Availability Impact:

HIGH

Weakness Type

What is a TOCTTOU Vulnerability?

The software checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the software to perform invalid actions when the resource is in an unexpected state. This weakness can be security-relevant when an attacker can influence the state of the resource between check and use. This can happen with shared resources such as files, memory, or even variables in multithreaded programs.

CVE-2023-33119 has been classified to as a TOCTTOU vulnerability or weakness.

Products Associated with CVE-2023-33119

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2023-33119 are published in these products:

Google Android

VMware ESXi

Qualcomm Aqt1000 Firmware

Qualcomm Ar8035 Firmware

Qualcomm Fastconnect 6200 Firmware

Qualcomm Fastconnect 6700 Firmware

Qualcomm Fastconnect 6800 Firmware

Qualcomm Fastconnect 6900 Firmware

Qualcomm Fastconnect 7800 Firmware

Qualcomm Qam8255p Firmware

Qualcomm Qam8295p Firmware

Qualcomm Qam8650p Firmware

Qualcomm Qam8775p Firmware

Qualcomm Qamsrv1h Firmware

Qualcomm Qamsrv1m Firmware

Qualcomm Qca6174a Firmware

Qualcomm Qca6310 Firmware

Qualcomm Qca6320 Firmware

Qualcomm Qca6335 Firmware

Qualcomm Qca6391 Firmware

Qualcomm Qca6420 Firmware

Qualcomm Qca6421 Firmware

Qualcomm Qca6426 Firmware

Qualcomm Qca6430 Firmware

Qualcomm Qca6431 Firmware

Qualcomm Qca6436 Firmware

Qualcomm Qca6564a Firmware

Qualcomm Qca6564au Firmware

Qualcomm Qca6574 Firmware

Qualcomm Qca6574a Firmware

Qualcomm Qca6574au Firmware

Qualcomm Qca6584au Firmware

Qualcomm Qca6595 Firmware

Qualcomm Qca6595au Firmware

Qualcomm Qca6678aq Firmware

Qualcomm Qca6696 Firmware

Qualcomm Qca6698aq Firmware

Qualcomm Qca6797aq Firmware

Qualcomm Qca8081 Firmware

Qualcomm Qca8337 Firmware

Qualcomm Qca9377 Firmware

Qualcomm Qcc710 Firmware

Qualcomm Qcm5430 Firmware

Qualcomm Qcm6490 Firmware

Qualcomm Qcm8550 Firmware

Qualcomm Qcn6224 Firmware

Qualcomm Qcn6274 Firmware

Qualcomm Qcs5430 Firmware

Qualcomm Qcs6490 Firmware

Qualcomm Qcs8550 Firmware

Qualcomm Qdu1000 Firmware

Qualcomm Qdu1010 Firmware

Qualcomm Qdu1110 Firmware

Qualcomm Qdu1210 Firmware

Qualcomm Qdx1010 Firmware

Qualcomm Qdx1011 Firmware

Qualcomm Qep8111 Firmware

Qualcomm Qfw7114 Firmware

Qualcomm Qfw7124 Firmware

Qualcomm Qru1032 Firmware

Qualcomm Qru1052 Firmware

Qualcomm Qru1062 Firmware

Qualcomm Qsm8350 Firmware

Qualcomm Video Collaboration Vc3 Platform Firmware

Qualcomm Robotics Rb3 Platform Firmware

Qualcomm Sa6145p Firmware

Qualcomm Sa6155 Firmware

Qualcomm Sa6155p Firmware

Qualcomm Sa7255p Firmware

Qualcomm Sa8150p Firmware

Qualcomm Sa8155 Firmware

Qualcomm Sa8155p Firmware

Qualcomm Sa8255p Firmware

Affected Versions

Qualcomm, Inc. Snapdragon:

Version AQT1000 is affected.
Version AR8035 is affected.
Version FastConnect 6200 is affected.
Version FastConnect 6700 is affected.
Version FastConnect 6800 is affected.
Version FastConnect 6900 is affected.
Version FastConnect 7800 is affected.
Version QAM8255P is affected.
Version QAM8295P is affected.
Version QAM8650P is affected.
Version QAM8775P is affected.
Version QAMSRV1H is affected.
Version QAMSRV1M is affected.
Version QCA6174A is affected.
Version QCA6310 is affected.
Version QCA6320 is affected.
Version QCA6335 is affected.
Version QCA6391 is affected.
Version QCA6420 is affected.
Version QCA6421 is affected.
Version QCA6426 is affected.
Version QCA6430 is affected.
Version QCA6431 is affected.
Version QCA6436 is affected.
Version QCA6564A is affected.
Version QCA6564AU is affected.
Version QCA6574 is affected.
Version QCA6574A is affected.
Version QCA6574AU is affected.
Version QCA6584AU is affected.
Version QCA6595 is affected.
Version QCA6595AU is affected.
Version QCA6678AQ is affected.
Version QCA6696 is affected.
Version QCA6698AQ is affected.
Version QCA6797AQ is affected.
Version QCA8081 is affected.
Version QCA8337 is affected.
Version QCA9377 is affected.
Version QCC710 is affected.
Version QCM5430 is affected.
Version QCM6490 is affected.
Version QCM8550 is affected.
Version QCN6224 is affected.
Version QCN6274 is affected.
Version QCS5430 is affected.
Version QCS6490 is affected.
Version QCS8550 is affected.
Version QDU1000 is affected.
Version QDU1010 is affected.
Version QDU1110 is affected.
Version QDU1210 is affected.
Version QDX1010 is affected.
Version QDX1011 is affected.
Version QEP8111 is affected.
Version QFW7114 is affected.
Version QFW7124 is affected.
Version QRU1032 is affected.
Version QRU1052 is affected.
Version QRU1062 is affected.
Version QSM8350 is affected.
Version Qualcomm Video Collaboration VC3 Platform is affected.
Version Robotics RB3 Platform is affected.
Version SA6145P is affected.
Version SA6155 is affected.
Version SA6155P is affected.
Version SA7255P is affected.
Version SA8150P is affected.
Version SA8155 is affected.
Version SA8155P is affected.
Version SA8255P is affected.
Version SA8295P is affected.
Version SA8540P is affected.
Version SA8620P is affected.
Version SA8650P is affected.
Version SA8770P is affected.
Version SA8775P is affected.
Version SA9000P is affected.
Version SC8380XP is affected.
Version SD 675 is affected.
Version SD 8 Gen1 5G is affected.
Version SD 8CX is affected.
Version SD670 is affected.
Version SD675 is affected.
Version SD835 is affected.
Version SD855 is affected.
Version SD865 5G is affected.
Version SDX55 is affected.
Version SDX57M is affected.
Version SG8275P is affected.
Version SM7250P is affected.
Version SM8550P is affected.
Version Snapdragon 670 Mobile Platform is affected.
Version Snapdragon 675 Mobile Platform is affected.
Version Snapdragon 678 Mobile Platform (SM6150-AC) is affected.
Version Snapdragon 765 5G Mobile Platform (SM7250-AA) is affected.
Version Snapdragon 765G 5G Mobile Platform (SM7250-AB) is affected.
Version Snapdragon 768G 5G Mobile Platform (SM7250-AC) is affected.
Version Snapdragon 8 Gen 1 Mobile Platform is affected.
Version Snapdragon 8 Gen 2 Mobile Platform is affected.
Version Snapdragon 8 Gen 3 Mobile Platform is affected.
Version Snapdragon 8+ Gen 2 Mobile Platform is affected.
Version Snapdragon 835 Mobile PC Platform is affected.
Version Snapdragon 845 Mobile Platform is affected.
Version Snapdragon 850 Mobile Compute Platform is affected.
Version Snapdragon 855 Mobile Platform is affected.
Version Snapdragon 855+/860 Mobile Platform (SM8150-AC) is affected.
Version Snapdragon 865 5G Mobile Platform is affected.
Version Snapdragon 865+ 5G Mobile Platform (SM8250-AB) is affected.
Version Snapdragon 870 5G Mobile Platform (SM8250-AC) is affected.
Version Snapdragon 888 5G Mobile Platform is affected.
Version Snapdragon 888+ 5G Mobile Platform (SM8350-AC) is affected.
Version Snapdragon 8c Compute Platform (SC8180X-AD) "Poipu Lite" is affected.
Version Snapdragon 8c Compute Platform (SC8180XP-AD) "Poipu Lite" is affected.
Version Snapdragon 8cx Compute Platform (SC8180X-AA, AB) is affected.
Version Snapdragon 8cx Compute Platform (SC8180XP-AC, AF) "Poipu Pro" is affected.
Version Snapdragon 8cx Gen 2 5G Compute Platform (SC8180X-AC, AF) "Poipu Pro" is affected.
Version Snapdragon 8cx Gen 2 5G Compute Platform (SC8180XP-AA, AB) is affected.
Version Snapdragon 8cx Gen 3 Compute Platform (SC8280XP-AB, BB) is affected.
Version Snapdragon AR2 Gen 1 Platform is affected.
Version Snapdragon Auto 5G Modem-RF Gen 2 is affected.
Version Snapdragon X24 LTE Modem is affected.
Version Snapdragon X35 5G Modem-RF System is affected.
Version Snapdragon X50 5G Modem-RF System is affected.
Version Snapdragon X55 5G Modem-RF System is affected.
Version Snapdragon X65 5G Modem-RF System is affected.
Version Snapdragon X72 5G Modem-RF System is affected.
Version Snapdragon X75 5G Modem-RF System is affected.
Version Snapdragon XR2 5G Platform is affected.
Version SRV1H is affected.
Version SRV1M is affected.
Version SSG2115P is affected.
Version SSG2125P is affected.
Version SXR1230P is affected.
Version SXR2130 is affected.
Version SXR2230P is affected.
Version SXR2250P is affected.
Version Vision Intelligence 300 Platform is affected.
Version Vision Intelligence 400 Platform is affected.
Version WCD9326 is affected.
Version WCD9335 is affected.
Version WCD9340 is affected.
Version WCD9341 is affected.
Version WCD9370 is affected.
Version WCD9375 is affected.
Version WCD9380 is affected.
Version WCD9385 is affected.
Version WCD9390 is affected.
Version WCD9395 is affected.
Version WCN3950 is affected.
Version WCN3980 is affected.
Version WCN3990 is affected.
Version WSA8810 is affected.
Version WSA8815 is affected.
Version WSA8830 is affected.
Version WSA8832 is affected.
Version WSA8835 is affected.
Version WSA8840 is affected.
Version WSA8845 is affected.
Version WSA8845H is affected.

qualcomm aqt1000_firmware:

Version - is affected.

qualcomm ar8035_firmware:

Version - is affected.

qualcomm fastconnect_6200_firmware:

Version - is affected.

qualcomm fastconnect_6700_firmware:

Version - is affected.

qualcomm fastconnect_6800_firmware:

Version - is affected.

qualcomm fastconnect_6900_firmware:

Version - is affected.

qualcomm fastconnect_7800_firmware:

Version - is affected.

qualcomm qam8255p_firmware:

Version - is affected.

qualcomm qam8295p_firmware:

Version - is affected.

qualcomm qam8650p_firmware:

Version - is affected.

qualcomm qam8775p_firmware:

Version - is affected.

qualcomm qamsrv1h_firmware:

Version - is affected.

qualcomm qamsrv1m_firmware:

Version - is affected.

qualcomm qca6174a_firmware:

Version - is affected.

qualcomm qca6310_firmware:

Version - is affected.

qualcomm qca6320_firmware:

Version - is affected.

qualcomm qca6335_firmware:

Version - is affected.

qualcomm qca6391_firmware:

Version - is affected.

qualcomm qca6420_firmware:

Version - is affected.

qualcomm qca6421_firmware:

Version - is affected.

qualcomm qca6426_firmware:

Version - is affected.

qualcomm qca6430_firmware:

Version - is affected.

qualcomm qca6431_firmware:

Version - is affected.

qualcomm qca6436_firmware:

Version - is affected.

qualcomm qca6564a_firmware:

Version - is affected.

qualcomm qca6564au_firmware:

Version - is affected.

qualcomm qca6574_firmware:

Version - is affected.

qualcomm qca6574a_firmware:

Version - is affected.

qualcomm qca6574au_firmware:

Version - is affected.

qualcomm qca6584au_firmware:

Version - is affected.

qualcomm qca6595_firmware:

Version - is affected.

qualcomm qca6595au_firmware:

Version - is affected.

qualcomm qca6678aq_firmware:

Version - is affected.

qualcomm qca6696_firmware:

Version - is affected.

qualcomm qca6698aq_firmware:

Version - is affected.

qualcomm qca6797aq_firmware:

Version - is affected.

qualcomm qca8081_firmware:

Version - is affected.

qualcomm qca8337_firmware:

Version - is affected.

qualcomm qca9377_firmware:

Version - is affected.

qualcomm qcc710_firmware:

Version - is affected.

qualcomm qcm5430_firmware:

Version - is affected.

qualcomm qcm6490_firmware:

Version - is affected.

qualcomm qcm8550_firmware:

Version - is affected.

qualcomm qcn6224_firmware:

Version - is affected.

qualcomm qcn6274_firmware:

Version - is affected.

qualcomm qcs5430_firmware:

Version - is affected.

qualcomm qcs6490_firmware:

Version - is affected.

qualcomm qcs8550_firmware:

Version - is affected.

qualcomm qdu1000_firmware:

Version - is affected.

qualcomm qdu1010_firmware:

Version - is affected.

qualcomm qdu1110_firmware:

Version - is affected.

qualcomm qdu1210_firmware:

Version - is affected.

qualcomm qdx1010_firmware:

Version - is affected.

qualcomm qdx1011_firmware:

Version - is affected.

qualcomm qep8111_firmware:

Version - is affected.

qualcomm qfw7114_firmware:

Version - is affected.

qualcomm qfw7124_firmware:

Version - is affected.

qualcomm qru1032_firmware:

Version - is affected.

qualcomm qru1052_firmware:

Version - is affected.

qualcomm qru1062_firmware:

Version - is affected.

qualcomm qsm8350_firmware:

Version - is affected.

qualcomm_video_collaboration_vc3_platform_firmware:

Version - is affected.

qualcomm robotics_rb3_platform_firmware:

Version - is affected.

qualcomm sa6145p_firmware:

Version - is affected.

qualcomm sa6155_firmware:

Version - is affected.

qualcomm sa6155p_firmware:

Version - is affected.

qualcomm sa7255p_firmware:

Version - is affected.

qualcomm sa8150p_firmware:

Version - is affected.

qualcomm sa8155_firmware:

Version - is affected.

qualcomm sa8155p_firmware:

Version - is affected.

qualcomm sa8255p_firmware:

Version - is affected.

Exploit Probability

EPSS

0.05%

Percentile

14.57%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.

VMware ESXi Memory Corruption via Unsynced Signed VM ImageCVE-2023-33119 Published on May 6, 2024

Vulnerability Analysis

Weakness Type

What is a TOCTTOU Vulnerability?

Products Associated with CVE-2023-33119

Affected Versions

Exploit Probability

VMware ESXi Memory Corruption via Unsynced Signed VM Image
CVE-2023-33119 Published on May 6, 2024