{"metadata": {"vulnerability": "CVE-2022-31705", "count": 33, "kinds": {"milestone": 6, "sighting": 8, "kev": 0, "other": 19}}, "data": [{"timestamp": "2022-05-25T00:00:00Z", "date_only": false, "value": "2022-05-25T00:00:00.000Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2022-31705", "field": "cveMetadata.dateReserved"}, {"timestamp": "2022-12-13T23:00:00Z", "date_only": false, "value": "2022-12-13T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-2318", "record": "WID-SEC-W-2022-2318", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2022-12-13T23:00:00Z", "date_only": false, "value": "2022-12-13T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-2318", "record": "WID-SEC-W-2022-2318", "field": "document.tracking.initial_release_date"}, {"timestamp": "2022-12-13T23:00:00Z", "date_only": false, "value": "2022-12-13T23:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-2318", "record": "WID-SEC-W-2022-2318", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2022-12-14T00:00:00Z", "date_only": false, "value": "2022-12-14T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2022-AVI-1096", "record": "CERTFR-2022-AVI-1096", "field": "last_revision_date"}, {"timestamp": "2022-12-14T00:00:00Z", "date_only": false, "value": "2022-12-14T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2022-AVI-1096", "record": "CERTFR-2022-AVI-1096", "field": "initial_release_date"}, {"timestamp": "2022-12-14T00:00:00Z", "date_only": false, "value": "2022-12-14T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2022-31705", "field": "cveMetadata.datePublished"}, {"timestamp": "2022-12-14T00:00:00Z", "date_only": false, "value": "2022-12-14T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2022-AVI-1096", "record": "CERTFR-2022-AVI-1096", "field": "revisions.0.revision_date"}, {"timestamp": "2022-12-14T00:00:00Z", "date_only": false, "value": "2022-12-14T00:00:00.000Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / vmware", "record": "CVE-2022-31705", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2022-12-14T08:14:08Z", "date_only": false, "value": "2022-12-14T08:14:08.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuus_27/2022", "record": "CVE-2022-31705", "field": "creation_timestamp", "uuid": "82f89d13-16ae-42a1-a130-81753c0666c2", "url": "https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuus_27/2022"}, {"timestamp": "2022-12-14T17:30:06Z", "date_only": false, "value": "2022-12-14T17:30:06.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/true_secator/3827", "record": "CVE-2022-31705", "field": "creation_timestamp", "uuid": "74eb1f09-08c6-493f-9de1-055dbc4a55d9", "content": "\u0413\u0438\u0433\u0430\u043d\u0442 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 VMware \u0432\u043e \u0432\u0442\u043e\u0440\u043d\u0438\u043a \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0441\u0440\u043e\u0447\u043d\u044b\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0442\u0440\u0435\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\n\n\u041e\u0434\u043d\u0430 \u0438\u0437 \u043d\u0438\u0445 \u0432\u043a\u043b\u044e\u0447\u0430\u0435\u0442 \u043e\u0448\u0438\u0431\u043a\u0443 \u0432\u044b\u0445\u043e\u0434\u0430 \u0438\u0437 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u044b, \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u043d\u0430 \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u043e\u043c \u043a\u043e\u043d\u043a\u0443\u0440\u0441\u0435 GeekPwn 2022, \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043c\u043e\u043c \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0439 Tencent Keen Security Lab.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c VM escape, \u0437\u0430\u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u043a\u0430\u043a CVE-2022-31705, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c Ant Security \u042e\u0445\u0430\u043e \u0426\u0437\u044f\u043d\u043e\u043c \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u044b \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u044b VMware Fusion, ESXi \u0438 Workstation.\n\nVMware \u043e\u043f\u0438\u0441\u0430\u043b\u0430 \u043e\u0448\u0438\u0431\u043a\u0443 \u043a\u0430\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u043f\u0438\u0441\u0438 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u043a\u0443\u0447\u0438 \u0432 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0435 USB 2.0 (EHCI). \u042d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u00a0\u0433\u043b\u0430\u0432\u043d\u044b\u0439 \u043f\u0440\u0438\u0437 \u043d\u0430 Geekpwn.\n\n\u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e\u00a0\u0431\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044e, VMWare \u043f\u0440\u0438\u0441\u0432\u043e\u0438\u043b\u0430 \u0435\u0439 \u0440\u0435\u0439\u0442\u0438\u043d\u0433 CVSS 9,3 \u0438 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0430, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0441 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u043c\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u043d\u0430 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u0435 \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u044d\u0442\u0443 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430.\n\n\u041d\u0430 ESXi \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442\u0441\u044f \u0432 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u0435 VMX, \u0442\u043e\u0433\u0434\u0430 \u043a\u0430\u043a \u043d\u0430 Workstation \u0438 Fusion \u044d\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a RCE \u043d\u0430 \u043c\u0430\u0448\u0438\u043d\u0435, \u0433\u0434\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0430 Workstation \u0438\u043b\u0438 Fusion.\n\n\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f, \u043e\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u044e\u0449\u0438\u0435 \u043f\u0430\u0440\u0443 \u043e\u0448\u0438\u0431\u043e\u043a \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434 \u0438 \u043e\u0431\u0445\u043e\u0434\u0430 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u043e\u0432, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0445 VMware vRealize Network Insight (vRNI).\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 vRNI REST API \u0442\u0430\u043a\u0436\u0435 \u043e\u0446\u0435\u043d\u0438\u0432\u0430\u0435\u0442\u0441\u044f VMware \u043a\u0430\u043a \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0441 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0439 \u0431\u0430\u0437\u043e\u0432\u043e\u0439 \u043e\u0446\u0435\u043d\u043a\u043e\u0439 CVSSv3 9,8, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a, \u0438\u043c\u0435\u044e\u0449\u0438\u0439 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a vRNI REST API, \u043c\u043e\u0436\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.", "url": "https://t.me/true_secator/3827"}, {"timestamp": "2022-12-14T19:15:00Z", "date_only": false, "value": "2022-12-14T19:15:00Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-JX8F-JJVW-F6VF", "record": "GHSA-JX8F-JJVW-F6VF", "field": "database_specific.nvd_published_at"}, {"timestamp": "2022-12-14T19:15:00Z", "date_only": false, "value": "2022-12-14T19:15Z", "kind": "other", "label": "Published Date", "source": "gsd \u00b7 GSD-2022-31705", "record": "GSD-2022-31705", "field": "namespaces.nvd.nist.gov.publishedDate"}, {"timestamp": "2022-12-14T19:15:13.197Z", "date_only": false, "value": "2022-12-14T19:15:13.197", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2022-31705", "record": "FKIE_CVE-2022-31705", "field": "published"}, {"timestamp": "2022-12-14T21:30:17Z", "date_only": false, "value": "2022-12-14T21:30:17Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-JX8F-JJVW-F6VF", "record": "GHSA-JX8F-JJVW-F6VF", "field": "published"}, {"timestamp": "2022-12-14T22:22:54Z", "date_only": false, "value": "2022-12-14T22:22:54.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cibsecurity/54552", "record": "CVE-2022-31705", "field": "creation_timestamp", "uuid": "28f34591-2372-4e49-a000-4da5f57af867", "content": "\u203c CVE-2022-31705 \u203c\n\nVMware ESXi, Workstation, and Fusion contain a heap out-of-bounds write vulnerability in the USB 2.0 controller (EHCI). A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox whereas, on Workstation and Fusion, this may lead to code execution on the machine where Workstation or Fusion is installed.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "url": "https://t.me/cibsecurity/54552"}, {"timestamp": "2022-12-19T15:43:00Z", "date_only": false, "value": "2022-12-19T15:43Z", "kind": "other", "label": "Last Modified Date", "source": "gsd \u00b7 GSD-2022-31705", "record": "GSD-2022-31705", "field": "namespaces.nvd.nist.gov.lastModifiedDate"}, {"timestamp": "2022-12-19T18:30:25Z", "date_only": false, "value": "2022-12-19T18:30:25Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-JX8F-JJVW-F6VF", "record": "GHSA-JX8F-JJVW-F6VF", "field": "modified"}, {"timestamp": "2023-01-08T23:00:00Z", "date_only": false, "value": "2023-01-08T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-2318", "record": "WID-SEC-W-2022-2318", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2023-01-08T23:00:00Z", "date_only": false, "value": "2023-01-08T23:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-2318", "record": "WID-SEC-W-2022-2318", "field": "document.tracking.current_release_date"}, {"timestamp": "2023-01-10T05:41:14Z", "date_only": false, "value": "2023-01-10T05:41:14.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/proxy_bar/1274", "record": "CVE-2022-31705", "field": "creation_timestamp", "uuid": "295f07dc-c8ab-4633-9e12-975b24dd3a03", "content": "CVE-2022-31705\nPOC\nGeekpwn 2022 Vmware EHCI OOB\ndownload", "url": "https://t.me/proxy_bar/1274"}, {"timestamp": "2023-01-11T11:01:01Z", "date_only": false, "value": "2023-01-11T11:01:01.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityTechnologies/7527", "record": "CVE-2022-31705", "field": "creation_timestamp", "uuid": "506a9cd9-b3cf-4729-a405-b4cb7e4ddb08", "content": "#exploit\n1. CVE-2022-31705:\nGeekpwn 2022 Vmware EHCI OOB\nhttps://github.com/s0duku/cve-2022-31705\n\n2. Linux >=4.10: UAF in __do_semtimedop() due to lockless check outside RCU section\nhttps://bugs.chromium.org/p/project-zero/issues/detail?id=2391\n\n3. Lexmark Printers/Copiers haxx 0-day Exploit\nhttps://github.com/blasty/lexmark", "url": "https://t.me/CyberSecurityTechnologies/7527"}, {"timestamp": "2023-01-11T16:20:13Z", "date_only": false, "value": "2023-01-11T16:20:13.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/crackcodes/2209", "record": "CVE-2022-31705", "field": "creation_timestamp", "uuid": "891f56b5-c2f4-45bf-ae79-a59bd8f619c4", "content": "#exploit\n1. CVE-2022-31705:\nGeekpwn 2022 Vmware EHCI OOB\nhttps://github.com/s0duku/cve-2022-31705\n\n2. Linux >=4.10: UAF in __do_semtimedop() due to lockless check outside RCU section\nhttps://bugs.chromium.org/p/project-zero/issues/detail?id=2391\n\n3. Lexmark Printers/Copiers haxx 0-day Exploit\nhttps://github.com/blasty/lexmark", "url": "https://t.me/crackcodes/2209"}, {"timestamp": "2023-01-12T11:54:51Z", "date_only": false, "value": "2023-01-12T11:54:51.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/crackcodes/2223", "record": "CVE-2022-31705", "field": "creation_timestamp", "uuid": "dca880d4-a8a4-4d8d-8a07-77aa18674175", "content": "CVE-2022-31705\nPOC\nGeekpwn 2022 Vmware EHCI OOB\ndownload", "url": "https://t.me/crackcodes/2223"}, {"timestamp": "2023-02-02T02:28:05Z", "date_only": false, "value": "2023-02-02T02:28:05.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/m-_AM4FJpiRJEcm3jCUXxS5qshgB4HVu9omgguHSr0D_t0s", "record": "CVE-2022-31705", "field": "creation_timestamp", "uuid": "c50dbac6-3ede-4732-a4ee-392c56c91235"}, {"timestamp": "2023-12-13T01:19:17.648Z", "date_only": false, "value": "2023-12-13T01:19:17.648527Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2022-31705", "record": "GSD-2022-31705", "field": "gsd.osvSchema.modified"}, {"timestamp": "2024-08-03T07:26:00.982Z", "date_only": false, "value": "2024-08-03T07:26:00.982Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "CVE-2022-31705", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2024-08-15T17:39:56.446Z", "date_only": false, "value": "2024-08-15T17:39:56.446+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-2318", "record": "WID-SEC-W-2022-2318", "field": "document.tracking.generator.date"}, {"timestamp": "2025-04-18T14:59:46.004Z", "date_only": false, "value": "2025-04-18T14:59:46.004073Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2022-31705", "field": "containers.adp.1.metrics.1.other.content.timestamp"}, {"timestamp": "2025-04-18T14:59:46.004Z", "date_only": false, "value": "2025-04-18T14:59:46.004073Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2022-31705", "record": "FKIE_CVE-2022-31705", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2025-04-18T15:03:03.117Z", "date_only": false, "value": "2025-04-18T15:03:03.117Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2022-31705", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2025-04-18T15:03:03.117Z", "date_only": false, "value": "2025-04-18T15:03:03.117Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2022-31705", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2026-06-17T04:46:08.507Z", "date_only": false, "value": "2026-06-17T04:46:08.507", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2022-31705", "record": "FKIE_CVE-2022-31705", "field": "lastModified"}]}