CVE-2025-22224

Published Mar 4, 2025

Last updated 3 months ago

Exploit known CVSS critical 9.3

VMware

VMware ESXi

VMware Workstation

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-22224 is a critical vulnerability affecting VMware ESXi and Workstation products. It's a time-of-check to time-of-use (TOCTOU) race condition flaw that can lead to an out-of-bounds write within the VMCI (Virtual Machine Communication Interface). An attacker with local administrator privileges on a virtual machine can exploit this vulnerability to execute code as the virtual machine's VMX process running on the host. This vulnerability allows attackers to escalate privileges from a compromised virtual machine to the underlying host system. Successful exploitation could grant the attacker control over the entire ESXi host, potentially impacting other virtual machines running on the same server. This vulnerability is known to be actively exploited in the wild.

Description: VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.
Source: security@vmware.com
NVD status: Analyzed
Products: esxi, cloud_foundation, telco_cloud_infrastructure, telco_cloud_platform, workstation

Risk scores

CVSS 3.1

Type: Primary
Base score: 8.2
Impact score: 6
Exploitability score: 1.5
Vector string: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Severity: HIGH

Known exploits

Data from CISA

Vulnerability name: VMware ESXi and Workstation TOCTOU Race Condition Vulnerability
Exploit added on: Mar 4, 2025
Exploit action due: Mar 25, 2025
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

nvd@nist.gov: CWE-367
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-367

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:vmware:esxi:7.0:-:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "5CBA6B5A-F345-41D1-8AA0-E5F274A2D8FB"
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:7.0:beta:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F030A666-1955-438B-8417-5C294905399F"
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:7.0:update_1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2C8DB7F6-5765-4355-B30E-9CAC39ECA5D9"
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:7.0:update_1a:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A790D41E-B398-4233-9EC7-CF5BE2BC3161"
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:7.0:update_1b:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B7619C16-5306-4C4A-88E8-E80876635F66"
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:7.0:update_1c:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "238E7AF4-722B-423D-ABB1-424286B06715"
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:7.0:update_1d:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "1E4DE8C7-72FB-4BEC-AD9E-378786295011"
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:7.0:update_1e:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2E6DE184-35C8-4A13-91D4-4B43E9F0168C"
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:7.0:update_2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D3E3A02D-6C1E-4DE8-B845-60F53C056F32"
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:7.0:update_2a:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "12D385F0-DB2B-4802-AD0E-31441DA056B9"
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:7.0:update_2c:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2C202879-9230-4E1D-BAB8-4FB7CE4BBC24"
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:7.0:update_2d:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "CC6DC107-5142-4155-A33B-D5BE72E9ED38"
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:7.0:update_2e:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "39817170-5C45-4F8A-916D-81B7352055DD"
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:7.0:update_3:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "4ADC3CFF-7415-46A5-817A-2F053B261E8C"
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:7.0:update_3c:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A2F831A7-544E-4B45-BA49-7F7A0234579C"
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:7.0:update_3d:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "80A0DD2E-F1CC-413B-91F9-E3986011A0A0"
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:7.0:update_3e:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C77771B2-BC64-47A5-B6DB-9CBCC4456B67"
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:7.0:update_3f:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "86DE9CE6-F6C0-47D2-B3AB-34852A8B9603"
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:7.0:update_3g:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E75B2F03-702E-4359-9BB2-E234F1DC38C8"
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:7.0:update_3i:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "ACAA9494-5248-4B01-8BC1-C38AB615FFD7"
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:7.0:update_3j:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "BF12014B-BF2B-42EF-B70C-59CDA8E2176F"
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:7.0:update_3k:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F965D853-EE4A-41F5-840B-2D009ACC9754"
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:7.0:update_3l:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "BA7B7313-FF53-43C9-AF4D-B639053D3FA3"
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:7.0:update_3m:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "9FB5738F-27E4-42C6-BD1B-F7F66A7EF0A6"
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:7.0:update_3n:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "FC3668A6-262B-42BF-9E90-28BAA9BB3347"
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:7.0:update_3o:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "DA4E9185-44BA-41E6-8600-C8616E199334"
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:7.0:update_3p:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F50302BB-B950-4178-A109-358393E0A50A"
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:7.0:update_3q:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "BCCA4A31-1291-4FB4-9FA5-D2CCD086D660"
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:7.0:update_3r:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "78604FE5-510F-4979-B2E3-D36B3083224A"
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:8.0:-:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7A1A402A-9262-4B97-A0B7-E5AE045E394D"
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:8.0:a:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "FE44B379-9943-4DD1-8514-26F87482AFA8"
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:8.0:b:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2A797377-8945-4D75-AA68-A768855E5842"
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:8.0:c:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "79D84D76-54BE-49E9-905C-7D65B4B42D68"
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:8.0:update_1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2F8767F7-7C3D-457D-9EAC-E8A30796F751"
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:8.0:update_1a:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "29AF8474-2D7A-4C5A-82B9-7A873AD90C2E"
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:8.0:update_1c:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7781A2CA-D927-48CD-9932-AE42B7BA1EFE"
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:8.0:update_1d:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "18FD08C9-5895-4BF4-BBE0-C2DDA5F6B836"
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:8.0:update_2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "360C1B71-5360-4379-B0DE-63BB8F5E6DA2"
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:8.0:update_2b:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B16ED7C1-9881-452A-8BE0-EDDEAEFE3D7B"
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:8.0:update_2c:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "ED92209F-FBD6-43F9-9A15-3842B139FCC9"
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:8.0:update_3:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "6B701151-1B57-4E2D-A9AB-586FACEA2385"
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:8.0:update_3b:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "4230B9AA-9E0C-4AE2-814D-8DD641394879"
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:8.0:update_3c:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F2FA150B-93E4-44D2-BF6D-347085A95776"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:vmware:cloud_foundation:-:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "31A7BB38-3238-413E-9736-F1A165D40867"
          },
          {
            "criteria": "cpe:2.3:a:vmware:telco_cloud_infrastructure:2.2:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7E46A694-8698-4283-9E25-01F222B63E9A"
          },
          {
            "criteria": "cpe:2.3:a:vmware:telco_cloud_infrastructure:2.5:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "59B9476F-E5E7-46B6-AC38-4630D0933462"
          },
          {
            "criteria": "cpe:2.3:a:vmware:telco_cloud_infrastructure:2.7:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "9A045567-2563-4539-8E95-361087CB7762"
          },
          {
            "criteria": "cpe:2.3:a:vmware:telco_cloud_infrastructure:3.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D11103A7-6AB5-4E78-BE11-BC2A04A09F19"
          },
          {
            "criteria": "cpe:2.3:a:vmware:telco_cloud_platform:2.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "6C5F01D7-2675-4D09-B52B-B02D0EF52AEA"
          },
          {
            "criteria": "cpe:2.3:a:vmware:telco_cloud_platform:2.5:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B5F8D61F-6E8B-4EE3-91DE-EBA6FF7D289E"
          },
          {
            "criteria": "cpe:2.3:a:vmware:telco_cloud_platform:2.7:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B1E94D58-26A0-4E84-8CAD-F8CDB6707642"
          },
          {
            "criteria": "cpe:2.3:a:vmware:telco_cloud_platform:3.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "FC33D39A-5760-467E-8284-F4E5D8082BBD"
          },
          {
            "criteria": "cpe:2.3:a:vmware:telco_cloud_platform:4.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "448206AA-A023-4AA1-98FD-35BC2A2AB2B5"
          },
          {
            "criteria": "cpe:2.3:a:vmware:telco_cloud_platform:4.0.1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "0F6E30F8-B977-40A5-9E45-89B5C5E59170"
          },
          {
            "criteria": "cpe:2.3:a:vmware:telco_cloud_platform:5.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D6B84F65-2E52-4445-8F97-2729B84B18E3"
          },
          {
            "criteria": "cpe:2.3:a:vmware:workstation:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "3124246D-3287-4657-B40D-E7B80A44E7D7",
            "versionEndExcluding": "17.6.3",
            "versionStartIncluding": "17.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.