VMware Products vSockets Information Disclosure Vulnerability

An information disclosure vulnerability has been identified in VMware ESXi, Workstation, Fusion, and VMware Tools. This vulnerability arises from the use of uninitialized memory in vSockets, potentially allowing a malicious actor with local administrative privileges on a virtual machine to leak memory from processes that communicate via vSockets.

Impact

Exploitation of this vulnerability could lead to unauthorized memory leakage from processes using vSockets, which may contain sensitive information.

Remediation

Users can update to VMware Tools version 13.0.1.0 or 12.5.3, depending on their current version. For VMware ESXi, Workstation, and Fusion, users should update to the latest versions available. Additional guidance for updating VMware Tools asynchronously is available in the VMware Tools Update Guidance FAQ.