CVE-2021-22042
📋 TL;DR
This vulnerability in VMware ESXi allows attackers with VMX process privileges to access the settingsd service running with high privileges. This could lead to unauthorized configuration changes or privilege escalation. Only VMware ESXi hypervisors are affected.
💻 Affected Systems
- VMware ESXi
📦 What is this software?
Esxi by Vmware
Esxi by Vmware
Esxi by Vmware
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the ESXi host, allowing attackers to modify virtual machine configurations, access sensitive data, or disrupt operations.
Likely Case
Unauthorized configuration changes to ESXi settings or virtual machines, potentially leading to service disruption or data exposure.
If Mitigated
Limited impact due to proper network segmentation and access controls restricting VMX process access.
🎯 Exploit Status
Exploitation requires existing VMX process privileges, making this primarily an insider threat or post-compromise escalation vector.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: ESXi70U3c-19193900, ESXi670-202111101-SG, ESXi650-202110101-SG
Vendor Advisory: https://www.vmware.com/security/advisories/VMSA-2022-0004.html
Restart Required: Yes
Instructions:
1. Download appropriate patch from VMware portal. 2. Place host in maintenance mode. 3. Apply patch via vSphere Lifecycle Manager or CLI. 4. Reboot host. 5. Verify patch installation.
🔧 Temporary Workarounds
Network Segmentation
allRestrict network access to ESXi management interfaces to trusted administrative networks only.
Access Control
allImplement strict access controls and monitoring for VMX process activities.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate ESXi management interfaces
- Enhance monitoring and alerting for unauthorized configuration changes
🔍 How to Verify
Check if Vulnerable:
Check ESXi version via vSphere Client or SSH: esxcli system version getCheck Version:
esxcli system version getVerify Fix Applied:
Verify installed patch version matches or exceeds patched versions listed in advisory📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to settingsd service
- Unexpected configuration changes in ESXi logs
Network Indicators:
- Unusual network traffic to ESXi management interfaces from non-admin sources
SIEM Query:
source="esxi" AND (event_type="settingsd_access" OR config_change="unauthorized")