TL;DR

An integer underflow vulnerability in VMware ESXi's VMCI allows local privilege escalation, rated as high severity by ZDI with a CVSS score of 8.2.

What happened

['Local attackers can exploit an integer underflow flaw to escalate privileges']

Why it matters for ops

['Vulnerability permits unauthorized access and control over affected systems', 'Enables lateral movement within the system environment']

Mitigation

  • Apply vendor-provided security patches immediately
  • Monitor system logs for suspicious activities related to VMCI

Action items

  • Update affected systems with the latest security updates
  • Review and tighten local privilege permissions on ESXi hosts

Detection IOCs

  • Unexpected privilege changes on VMware ESXi hosts
  • Unusual network traffic patterns related to VM communication interfaces

Source link

http://www.zerodayinitiative.com/advisories/ZDI-26-188/