Ce mail provient de l'extérieur, restons vigilants ===================================================================== CERT-Renater Note d'Information No. 2025/VULN451 _____________________________________________________________________ DATE : 16/07/2025 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running VMware Cloud Foundation, VMware Cloud Foundation, VMware Fusion, VMware Telco Cloud Infrastructure, VMware Telco Cloud Platform, VMware vSphere ESXi, VMware vSphere Foundation, VMware Workstation . ===================================================================== https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/35877 _____________________________________________________________________ VMSA-2025-0013: VMware ESXi, Workstation, Fusion, and Tools updates address multiple vulnerabilities (CVE-2025-41236, CVE-2025-41237, CVE-2025-41238, CVE-2025-41239) Product/Component VMware Cloud Foundation VMware Cloud Foundation VMware Fusion VMware Telco Cloud Infrastructure VMware Telco Cloud Platform VMware vSphere ESXi VMware vSphere Foundation VMware Workstation Notification Id 35877 Last Updated 15 July 2025 Initial Publication Date 15 July 2025 Status OPEN Severity CRITICAL CVSS Base Score 6.2-9.3 WorkAround None Affected CVE CVE-2025-41236, CVE-2025-41237, CVE-2025-41238, CVE-2025-41239 Advisory ID: VMSA-2025-0013 Advisory Severity: Critical CVSSv3 Range: 6.2-9.3 Synopsis: VMware ESXi, Workstation, Fusion, and Tools updates address multiple vulnerabilities (CVE-2025-41236, CVE-2025-41237, CVE-2025-41238, CVE-2025-41239) Issue date: 2025-07-15 Updated on: 2025-07-15 (Initial Advisory) CVE(s) CVE-2025-41236, CVE-2025-41237, CVE-2025-41238, CVE-2025-41239 1. Impacted Products VMware Cloud Foundation VMware vSphere Foundation VMware ESXi VMware Workstation Pro VMware Fusion VMware Tools VMware Telco Cloud Platform VMware Telco Cloud Infrastructure 2. Introduction Multiple vulnerabilities in VMware ESXi, Workstation, Fusion, and Tools were privately reported to Broadcom. Updates are available to remediate these vulnerabilities in affected Broadcom products. 3a. VMXNET3 integer-overflow vulnerability (CVE-2025-41236) Description: VMware ESXi, Workstation, and Fusion contain an integer-overflow vulnerability in the VMXNET3 virtual network adapter. Broadcom has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.3. Known Attack Vectors: A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Non VMXNET3 virtual adapters are not affected by this issue. Resolution: To remediate CVE-2025-41236 apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' found below. Workarounds: None Additional Documentation: A supplemental FAQ was created for clarification. Please see: https://brcm.tech/vmsa-2025-0013-qna. Acknowledgments: Broadcom would like to thank Nguyen Hoang Thach (@hi_im_d4rkn3ss) of STARLabs SG working with the Pwn2Own held by Zero day initiative for reporting this issue to us. Notes: None. 3b. VMCI integer-underflow vulnerability (CVE-2025-41237) Description: VMware ESXi, Workstation, and Fusion contain an integer-underflow in VMCI (Virtual Machine Communication Interface) that leads to an out-of-bounds write. Broadcom has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.3. Known Attack Vectors: A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox whereas, on Workstation and Fusion, this may lead to code execution on the machine where Workstation or Fusion is installed. Resolution: To remediate CVE-2025-41237 apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' found below. Workarounds: None Additional Documentation: A supplemental FAQ was created for clarification. Please see: https://brcm.tech/vmsa-2025-0013-qna. Acknowledgments: Broadcom would like to thank Corentin BAYET (@OnlyTheDuck) of REverse Tactics (@Reverse_Tactics) working with the Pwn2Own held by Zero day initiative for reporting this issue to us. Notes: None 3c. PVSCSI heap-overflow vulnerability (CVE-2025-41238) Description: VMware ESXi, Workstation, and Fusion contain a heap-overflow vulnerability in the PVSCSI (Paravirtualized SCSI) controller that leads to an out of-bounds write. Broadcom has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.3. Known Attack Vectors: A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox and exploitable only with configurations that are unsupported. On Workstation and Fusion, this may lead to code execution on the machine where Workstation or Fusion is installed. Resolution: To remediate CVE-2025-41238 apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' found below. Workarounds: None Additional Documentation: A supplemental FAQ was created for clarification. Please see: https://brcm.tech/vmsa-2025-0013-qna. Acknowledgments: Broadcom would like to thank Thomas Bouzerar (@MajorTomSec) and Etienne Helluy-Lafont of Synacktiv working with the Pwn2Own held by Zero day initiative for reporting this issue to us. Notes: None. 3d. vSockets information-disclosure vulnerability (CVE-2025-41239) Description: VMware ESXi, Workstation, Fusion, and VMware Tools contains an information disclosure vulnerability due to the usage of an uninitialised memory in vSockets. Broadcom has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.1. Known Attack Vectors: A malicious actor with local administrative privileges on a virtual machine may be able to exploit this issue to leak memory from processes communicating with vSockets. Resolution: To remediate CVE-2025-41239 apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' found below. Workarounds: None Additional Documentation: A supplemental FAQ was created for clarification. Please see: https://brcm.tech/vmsa-2025-0013-qna. Acknowledgments: Broadcom would like to thank Corentin BAYET (@OnlyTheDuck) of REverse Tactics (@Reverse_Tactics) working with the Pwn2Own held by Zero day initiative and Gwangun Jung of THEORI working with Trend Micro Zero Day Initiative for independently reporting this issue to us. Notes: [1] CVE-2025-41239 affects VMware Tools for Windows. Please check the FAQ for additional guidance if you are running VMware Tools for Windows. [2] VMware Tools 12.4.8 which is part of VMware Tools 12.5.3, also addresses the issue for Windows 32-bit. Response Matrix: VMware Product Component Version Running On CVE CVSSv3 Severity Fixed Version Workarounds Additional Documentation VMware Cloud Foundation, VMware vSphere Foundation ESX 9.0.0.0 Any CVE-2025-41236, CVE-2025-41238, CVE-2025-41239 N/A N/A Unaffected N/A N/A ESX 9.0.0.0 Any CVE-2025-41237 8.4 Important ESXi-9.0.0.0100-24813472 None Additional guidance for updating VMware Tools asynchronously is available in the FAQ. VMware Tools [1] 13.0.0.0 Windows CVE-2025-41239 6.2 Moderate 13.0.1.0 None FAQ _____________________________________________________________________ VMware ESXi N/A 8.0 Any CVE-2025-41236, CVE-2025-41237, CVE-2025-41238, CVE-2025-41239 9.3, 8.4, 7.4, 7.1 Critical ESXi80U3f-24784735 None Additional guidance for updating VMware Tools asynchronously is available in the FAQ. VMware ESXi N/A 8.0 Any CVE-2025-41236, CVE-2025-41237, CVE-2025-41238, CVE-2025-41239 9.3, 8.4, 7.4, 7.1 Critical ESXi80U2e-24789317 None Additional guidance for updating VMware Tools asynchronously is available in the FAQ. VMware ESXi N/A 7.0 Any CVE-2025-41236, CVE-2025-41237, CVE-2025-41238, CVE-2025-41239 9.3, 8.4, 7.4, 7.1 Critical ESXi70U3w-24784741 None Additional guidance for updating VMware Tools asynchronously is available in the FAQ. VMware Workstation N/A 17.x Any CVE-2025-41236, CVE-2025-41237, CVE-2025-41238, CVE-2025-41239 9.3, 9.3, 9.3, 7.1 Critical 17.6.4 None FAQ VMware Fusion N/A 13.x Any CVE-2025-41236, CVE-2025-41237, CVE-2025-41238, CVE-2025-41239 9.3, 9.3, 9.3, 7.1 Critical 13.6.4 None FAQ VMware Cloud Foundation N/A 5.x Any CVE-2025-41236, CVE-2025-41237, CVE-2025-41238, CVE-2025-41239 9.3, 8.4, 7.4, 7.1 Critical Async patch to ESXi80U3f-24784735 None Async Patching Guide: KB88287 VMware Cloud Foundation N/A 4.5.x Any CVE-2025-41236, CVE-2025-41237, CVE-2025-41238, CVE-2025-41239 9.3, 8.4, 7.4, 7.1 Critical Async patch to ESXi70U3w-24784741 None Async Patching Guide: KB88287 VMware Telco Cloud Platform N/A 5.x, 4.x Any CVE-2025-41236, CVE-2025-41237, CVE-2025-41238, CVE-2025-41239 9.3, 8.4, 7.4, 7.1 Critical ESXi80U3f-24784735 None FAQ VMware Telco Cloud Platform N/A 3.x, 2.x Any CVE-2025-41236, CVE-2025-41237, CVE-2025-41238, CVE-2025-41239 9.3, 8.4, 7.4, 7.1 Critical ESXi70U3w-24784741 None FAQ VMware Telco Cloud Infrastructure N/A 3.x, 2.x Any CVE-2025-41236, CVE-2025-41237, CVE-2025-41238, CVE-2025-41239 9.3, 8.4, 7.4, 7.1 Critical ESXi70U3w-24784741 FAQ VMware Tools [1] N/A 13.x.x Windows CVE-2025-41239 6.2 Moderate 13.0.1.0 None FAQ VMware Tools [1] N/A 12.x.x, 11.x.x Windows CVE-2025-41239 6.2 Moderate 12.5.3 [2] None FAQ VMware Tools N/A 13.x.x, 12.x.x, 11.x.x Linux CVE-2025-41239 N/A N/A Unaffected N/A N/A VMware Tools N/A 13.x.x, 12.x.x, 11.x.x macOS CVE-2025-41239 N/A N/A Unaffected N/A N/A 4. References VMware Cloud Foundation 9.0.0.0.0 Downloads and Documentation: https://support.broadcom.com/group/ecx/productfiles?displayGroup=VMware%20Cloud%20Foundation%209&release=9.0.0.0&os=&servicePk=&language=EN&groupId=529537&viewGroup=true VMware vSphere Foundation 9.0.0.0.0 Downloads and Documentation: https://support.broadcom.com/group/ecx/productfiles?displayGroup=VMware%20vSphere%20Foundation%209&release=9.0.0.0&os=&servicePk=&language=EN&groupId=529542&viewGroup=true VMware ESXi 8.0 ESXi80U3f-24784735 Downloads and Documentation: https://support.broadcom.com/web/ecx/solutiondetails?patchId=15938 https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere/8-0/release-notes/esxi-update-and-patch-release-notes/vsphere-esxi-80u3f-release-notes.html VMware ESXi 8.0 ESXi80U2e-24789317 Downloads and Documentation: https://support.broadcom.com/web/ecx/solutiondetails?patchId=15939 https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere/8-0/release-notes/esxi-update-and-patch-release-notes/vsphere-esxi-80u2e-release-notes.html VMware ESXi 7.0 ESXi70U3w-24784741 Downloads and Documentation: https://support.broadcom.com/web/ecx/solutiondetails?patchId=15940 https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere/7-0/release-notes/esxi-update-and-patch-release-notes/vsphere-esxi-70u3w-release-notes.html VMware Workstation 17.6.4 Downloads and Documentation: https://support.broadcom.com/group/ecx/productdownloads?subfamily=VMware%20Workstation%20Pro&freeDownloads=true https://techdocs.broadcom.com/us/en/vmware-cis/desktop-hypervisors/workstation-pro/17-0/release-notes/vmware-workstation-1764-pro-release-notes.html VMware Fusion 13.6.4 Downloads and Documentation: https://support.broadcom.com/group/ecx/productdownloads?subfamily=VMware%20Fusion&freeDownloads=true https://techdocs.broadcom.com/us/en/vmware-cis/desktop-hypervisors/fusion-pro/13-0/release-notes/vmware-fusion-1364-release-notes.html VMware Cloud Foundation 5.x, 4.5.x Downloads and Documentation: https://knowledge.broadcom.com/external/article?legacyId=88287 VMware Tools 13.0.1.0 Downloads and Documentation: https://support.broadcom.com/group/ecx/productfiles?subFamily=VMware%20Tools&displayGroup=VMware%20Tools%2013.x&release=13.0.1.0&os=&servicePk=&language=EN&freeDownloads=true https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/tools/13-0-0/release-notes/vmware-tools-1301-release-notes.html VMware Tools 12.5.3 Downloads and Documentation: https://support.broadcom.com/group/ecx/productfiles?subFamily=VMware%20Tools&displayGroup=VMware%20Tools%2012.x&release=12.5.3&os=&servicePk=&language=EN&freeDownloads=true https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/tools/12-5-0/release-notes/vmware-tools-1253-release-notes.html Mitre CVE Dictionary Links: https://www.cve.org/CVERecord?id=CVE-2025-41236 https://www.cve.org/CVERecord?id=CVE-2025-41237 https://www.cve.org/CVERecord?id=CVE-2025-41238 https://www.cve.org/CVERecord?id=CVE-2025-41239 FIRST CVSSv3 Calculator: CVE-2025-41236: https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVE-2025-41237: ESXi: https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Workstation/Fusion: https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVE-2025-41238: ESXi: https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Workstation/Fusion: https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVE-2025-41239: ESXi/Workstation/Fusion: https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Tools: https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N 5. Change Log: 2025-07-15 VMSA-2025-0013 Initial security advisory. 6. Contact: E-mail: vmware.psirt@broadcom.com PGP key https://knowledge.broadcom.com/external/article/321551 VMware Security Advisories https://www.broadcom.com/support/vmware-security-advisories VMware External Vulnerability Response and Remediation Policy https://www.broadcom.com/support/vmware-services/security-response VMware Lifecycle Support Phases 
https://support.broadcom.com/group/ecx/productlifecycle VMware Security Blog 
https://blogs.vmware.com/security X https://x.com/VMwareSRC Copyright 2025 Broadcom. All rights reserved. ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================