一、误差概述
误差名称 | VMware VMXNET3整数溢出误差 |
CVE ID | CVE-2025-41236 |
误差类型 | 整数溢出 | 发明时间 | 2025-07-17 |
误差评分 | 9.3 | 误差品级 | 严重 |
攻击向量 | 外地 | 所需权限 | 无 |
使用难度 | 低 | 用户交互 | 需要 |
PoC/EXP | 未果真 | 在野使用 | 未发明 |
VMXNET3是VMware提供的高性能虚拟网络适配器 ；VMCI（Virtual Machine Communication Interface）用于虚拟机与宿主机之间的高效通讯 ；PVSCSI是面向高性能存储的虚拟化SCSI控制器 ；vSockets提供虚拟机与宿主机或虚拟机之间的套接字通讯机制，用于低延迟数据传输 。
2025年7月17日，尊龙凯时集团VSRC监测到VMware官方披露其多个产品中保存四个高危误差，涉及VMXNET3、VMCI、PVSCSI和vSockets等要害虚拟化组件，划分为VMware VMXNET3整数溢出误差（CVE-2025-41236）、VMware VMCI整数下溢误差（CVE-2025-41237）、VMware PVSCSI堆溢出误差（CVE-2025-41238）以及VMware vSockets信息泄露误差（CVE-2025-41239） 。其中，前三个误差可被具备外地治理员权限的攻击者在虚拟机内使用，最终以VMX历程权限在宿主机上实现远程代码执行，严重威胁虚拟化平台的系统清静 ；CVE-2025-41239则由于vSockets组件保存未初始化内存使用问题，可能导致攻击者泄露与其通讯历程的敏感内存信息 。
二、影响规模
VMware Cloud Foundation ESX = 9.0.0.0 VMware Workstation = 17.x VMware Cloud Foundation = 4.5.x VMware Cloud Foundation = 5.x VMware Telco Cloud Platform = 2.x VMware Telco Cloud Platform = 3.x VMware Telco Cloud Platform = 4.x VMware Telco Cloud Platform = 5.x VMware Telco Cloud Infrastructure = 2.x VMware Telco Cloud Infrastructure = 3.x
CVE-2025-41237影响规模
VMware vSphere Foundation ESX = 9.0.0.0VMware Workstation = 17.xVMware Cloud Foundation ESX = 9.0.0.0VMware Cloud Foundation = 4.5.xVMware Cloud Foundation = 5.xVMware Telco Cloud Platform = 2.xVMware Telco Cloud Platform = 3.xVMware Telco Cloud Platform = 4.xVMware Telco Cloud Platform = 5.xVMware Telco Cloud Infrastructure = 2.xVMware Telco Cloud Infrastructure = 3.x
CVE-2025-41238影响规模
VMware Cloud Foundation ESX = 9.0.0.0VMware Workstation = 17.xVMware Cloud Foundation = 4.5.xVMware Cloud Foundation = 5.xVMware Telco Cloud Platform = 2.xVMware Telco Cloud Platform = 3.xVMware Telco Cloud Platform = 4.xVMware Telco Cloud Platform = 5.xVMware Telco Cloud Infrastructure = 2.xVMware Telco Cloud Infrastructure = 3.x
CVE-2025-41239影响规模
VMware Cloud Foundation ESX = 9.0.0.0VMware vSphere Foundation ESX = 9.0.0.0VMware Cloud Foundation VMware Tools for Windows = 13.0.0.0VMware vSphere Foundation VMware Tools for Windows = 13.0.0.0VMware Workstation = 17.xVMware Cloud Foundation = 4.5.xVMware Cloud Foundation = 5.xVMware Telco Cloud Platform = 2.xVMware Telco Cloud Platform = 3.xVMware Telco Cloud Platform = 4.xVMware Telco Cloud Platform = 5.xVMware Telco Cloud Infrastructure = 2.xVMware Telco Cloud Infrastructure = 3.xVMware Tools for Windows = 11.x.xVMware Tools for Windows = 12.x.xVMware Tools for Windows = 13.x.xVMware Tools for Linux = 11.x.xVMware Tools for Linux = 12.x.xVMware Tools for Linux = 13.x.xVMware Tools for macOS = 11.x.xVMware Tools for macOS = 12.x.xVMware Tools for macOS = 13.x.x
三、清静步伐
3.1 升级版本
VMware vSphere Foundation ESX 9.0.0.0 升级至ESXi-9.0.0.0100-24813472VMware Tools 13.0.0.0（Windows）升级至13.0.1.0VMware ESXi 8.0：升级至ESXi80U3f-24784735或升级至ESXi80U2e-24789317VMware ESXi 7.0：升级至ESXi70U3w-24784741VMware Workstation 17.x：升级至 17.6.4VMware Fusion 13.x升级至13.6.4VMware Cloud Foundation版本 5.x：异步补丁至ESXi80U3f-24784735VMware Cloud Foundation版本 4.5.x：异步补丁至ESXi70U3w-24784741VMware Telco Cloud Platform版本 5.x / 4.x：升级至ESXi80U3f-24784735VMware Telco Cloud Platform版本 3.x / 2.x：升级至ESXi70U3w-24784741VMware Telco Cloud Infrastructure（3.x / 2.x）升级至ESXi70U3w-24784741VMware Tools Windows 13.xx：升级至13.0.1.0VMware Tools Windows 12.xx / 11.xx：升级至12.5.3
下载链接：
VMware Cloud Foundation 9.0.0.0.0https://support.broadcom.com/group/ecx/productfiles?displayGroup=VMware%20Cloud%20Foundation%209&release=9.0.0.0&os=&servicePk=&language=EN&groupId=529537&viewGroup=true
VMware vSphere Foundation 9.0.0.0.0
https://support.broadcom.com/group/ecx/productfiles?displayGroup=VMware%20vSphere%20Foundation%209&release=9.0.0.0&os=&servicePk=&language=EN&groupId=529542&viewGroup=true
VMware ESXi 8.0 ESXi80U3f-24784735
https://support.broadcom.com/web/ecx/solutiondetails?patchId=15938https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere/8-0/release-notes/esxi-update-and-patch-release-notes/vsphere-esxi-80u3f-release-notes.html
VMware ESXi 8.0 ESXi80U2e-24789317
https://support.broadcom.com/web/ecx/solutiondetails?patchId=15939https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere/8-0/release-notes/esxi-update-and-patch-release-notes/vsphere-esxi-80u2e-release-notes.html
VMware ESXi 7.0 ESXi70U3w-24784741
https://support.broadcom.com/web/ecx/solutiondetails?patchId=15940https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere/7-0/release-notes/esxi-update-and-patch-release-notes/vsphere-esxi-70u3w-release-notes.html
VMware Workstation 17.6.4
https://support.broadcom.com/group/ecx/productdownloads?subfamily=VMware%20Workstation%20Pro&freeDownloads=truehttps://techdocs.broadcom.com/us/en/vmware-cis/desktop-hypervisors/workstation-pro/17-0/release-notes/vmware-workstation-1764-pro-release-notes.html
VMware Fusion 13.6.4
https://support.broadcom.com/group/ecx/productdownloads?subfamily=VMware%20Fusion&freeDownloads=truehttps://techdocs.broadcom.com/us/en/vmware-cis/desktop-hypervisors/fusion-pro/13-0/release-notes/vmware-fusion-1364-release-notes.html
VMware Cloud Foundation 5.x, 4.5.x
https://knowledge.broadcom.com/external/article?legacyId=88287
VMware Tools 13.0.1.0
https://support.broadcom.com/group/ecx/productfiles?subFamily=VMware%20Tools&displayGroup=VMware%20Tools%2013.x&release=13.0.1.0&os=&servicePk=&language=EN&freeDownloads=truehttps://techdocs.broadcom.com/us/en/vmware-cis/vsphere/tools/13-0-0/release-notes/vmware-tools-1301-release-notes.html
VMware Tools 12.5.3
https://support.broadcom.com/group/ecx/productfiles?subFamily=VMware%20Tools&displayGroup=VMware%20Tools%2012.x&release=12.5.3&os=&servicePk=&language=EN&freeDownloads=truehttps://techdocs.broadcom.com/us/en/vmware-cis/vsphere/tools/12-5-0/release-notes/vmware-tools-1253-release-notes.html
3.2 暂时步伐
暂无 。
3.3 通用建议
?按期更新系统补丁，镌汰系统误差，提升服务器的清静性 。?增强系统和网络的会见控制，修改防火墙战略，关闭非须要的应用端口或服务，镌汰将危险服务（如SSH、RDP等）袒露到公网，镌汰攻击面 。?增强系统用户和权限治理，启用多因素认证机制和最小权限原则，用户和软件权限应坚持在最低限度 。
3.4 参考链接
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/35877
京公网安备11010802024551号