vmware vcenter-server CVE-2024-38812 is a vulnerability in VMware Vcenter Server
Published on September 17, 2024

The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.

Vendor Advisory NVD

Known Exploited Vulnerability

This VMware vCenter Server Heap-Based Buffer Overflow Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. VMware vCenter Server contains a heap-based buffer overflow vulnerability in the implementation of the DCERPC protocol. This vulnerability could allow an attacker with network access to the vCenter Server to execute remote code by sending a specially crafted packet.

The following remediation steps are recommended / required by December 11, 2024: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Vulnerability Analysis

CVE-2024-38812 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. It has the highest possible exploitability rating (3.9). The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.

What is a Memory Corruption Vulnerability?

The software writes data past the end, or before the beginning, of the intended buffer. Typically, this can result in corruption of data, a crash, or code execution. The software may modify an index or perform pointer arithmetic that references a memory location that is outside of the boundaries of the buffer. A subsequent write operation then produces undefined or unexpected results.

CVE-2024-38812 has been classified to as a Memory Corruption vulnerability or weakness.


Products Associated with CVE-2024-38812

You can be notified by stack.watch whenever vulnerabilities like CVE-2024-38812 are published in these products:

VMware Vcenter Server
 

What versions of Vcenter Server are vulnerable to CVE-2024-38812?