Database/Kernel, userspace & hypervisor
VMware vCenter Server: sudo misconfiguration lets a local non-admin user become root
Impact
Several sudo misconfigurations on the vCenter Server Appliance let an authenticated local user without administrative privileges escalate to root. vCenter is the control point for an ESXi estate, including GPU-passthrough and vGPU hosts, so root on the appliance means control over host configuration, VM placement and the credentials vCenter holds for every host it manages. The precondition is meaningful: the attacker needs an existing local account on the appliance shell, which in a well-run deployment is a small set of operators.
Who can reach it
An authenticated local user with a non-administrative account on the vCenter Server Appliance shell.
What to do
Apply the vCenter Server patches listed in Broadcom advisory VMSA-2024-0012 (also covers VMware Cloud Foundation via async patch); updating vCenter means a management-plane outage and an appliance reboot, but ESXi hosts and their running GPU workloads are not drained. Broadcom states no in-product workaround.
References
Related entries
- Microsoft Hyper-V: Hyper-V elevation of privilege, exploited in the wildCVE-2024-38080 · Microsoft Hyper-VHigh
- Linux kernel (drivers/gpu/drm): DRM core stores a pointer to the caller's struct pid before taking a reference on itCVE-2024-39486 · Linux kernel (drivers/gpu/drm)High
- Linux kernel BPF: use-after-free in bpf_link_free when a link uses deferred deallocationCVE-2024-40909 · Linux kernel BPF (bpf_link_free deferred dealloc)High
- Linux kernel mlx5_ib (shared receive queue): The max_sge attribute for a shared receive queue is taken from the userCVE-2024-40990 · Linux kernel mlx5_ib (shared receive queue)High
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A correctness defect in the amdkfd (KFD computeCVE-2024-41011 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High
- Linux kernel BPF: use-after-free freeing map elements that hold BPF timersCVE-2024-41045 · Linux kernel BPF timers (bpf_timer_cancel_and_free, hrtimer freed while still enqueued)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.