DaystoPatch

Broadcom (VMware)Exploited incident

VMware vCenter Server DCERPC heap overflow and privilege escalation (VMSA-2024-0019)

CVE-2024-38812, CVE-2024-38813Critical, CVSS 9.8In CISA's Known Exploited Vulnerabilities catalog since 20 Nov 2024

  • Exploited after a fix existed
FixedFixed for every supported version 34 days after the first public report.

Response

Silence
same day
First public report to first vendor statement
Exposure
34d
First public report to first fix
Follow-through
34d
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    date only

    Broadcom VMSA-2024-0019 (Wayback snapshot 2024-09-17)CuratedQuote verified

    A heap-overflow vulnerability and a privilege escalation vulnerability in vCenter Server were responsibly reported to VMware. Updates are available to remediate these vulnerabilities in affected VMware products.

    Coordinated disclosure (Issue date 2024-09-17), bugs reported through the 2024 Matrix Cup contest. Exploitation was confirmed only on 2024-11-18 (next candidate).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:94966c193ce0afde…
    Used in metrics
    Yes
    Dispute this timestamp
    6 more sources for this moment
    Bluesky postClaimedQuote not checked yet17 Sep 2024, 16:30 UTC

    VMSA-2024-0019:VMware vCenter Server updates address heap-overflow and privilege escalation vulnerabilities (CVE-2024-38812, CVE-2024-38813) - Broadcom https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24968

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2024-38812ClaimedQuote verified17 Sep 2024, 17:13 UTC

    The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:59ab70d5b0744f78…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet18 Sep 2024, 07:19 UTC

    "VMware Patches Remote Code Execution Flaw Found in Chinese Hacking Contest" ⬇️ "The most severe of the two, tagged as CVE-2024-38812 ... VMware warned that an attacker with network access to the server could send a specially crafted packet to execute remote code. The flaw carries a CVSS severity

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Broadcom VMSA-2024-0019.3 (Wayback snapshot 2024-11-19)CuratedQuote verified18 Nov 2024

    VMware by Broadcom confirmed that exploitation has occurred in the wild for CVE-2024-38812.

    Change log: '2024-11-18 VMSA-2024-0019.3 Updated advisory to note that VMware by Broadcom confirmed that exploitation has occurred in the wild for CVE-2024-38812 and CVE-2024-38813.'

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:07c68eafabfb12f1…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2024-38812)ClaimedQuote verified20 Nov 2024

    VMware vCenter Server Heap-Based Buffer Overflow Vulnerability

    Added to CISA's KEV catalog on 2024-11-20.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2024-38813)ClaimedQuote verified20 Nov 2024

    VMware vCenter Server Privilege Escalation Vulnerability

    Added to CISA's KEV catalog on 2024-11-20.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    date onlysame day

    Broadcom VMSA-2024-0019 change log (Wayback snapshot 2024-11-19)CuratedQuote verified

    2024-09-17 VMSA-2024-0019

    Change log line '2024-09-17 VMSA-2024-0019 Initial security advisory.'

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:07c68eafabfb12f1…
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    date only+34d

    Broadcom VMSA-2024-0019.2 (Wayback snapshot 2024-11-19)CuratedQuote verified

    Updated Response Matrix with latest vCenter patches released on 2024-10-21 that fully address CVE-2024-38812.

    First complete fix for CVE-2024-38812 (vCenter 8.0 U3d, 8.0 U2e, 7.0 U3t). Under R1 this is patch_first: Broadcom says the 2024-09-17 patches 'did not fully address CVE-2024-38812'.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:07c68eafabfb12f1…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    date only+34d

    Broadcom VMSA-2024-0019.2 (Wayback snapshot 2024-11-19)CuratedQuote verified

    IMPORTANT: VMware by Broadcom has determined that the vCenter patches released on September 17, 2024 did not fully address CVE-2024-38812. All customers are strongly encouraged to apply the patches currently listed in the Response Matrix. Additionally, patches for 8.0 U2 line are also available.

    From 2024-10-21 the matrix covers every line with complete fixes: 8.0 U3d, 8.0 U2e (new line), 7.0 U3t, VCF 5.x/5.1.x/4.x via async patches (KB88287).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:07c68eafabfb12f1…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • VMware vCenter Server 7.0 and 8.0
  • VMware Cloud Foundation 4.x and 5.x
How we built this timeline

Grouped: both CVEs are in one advisory and Broadcom confirmed exploitation of both on 18 Nov 2024; both added to KEV 20 Nov 2024. R1 (correction pass 23 Oct 2026): the 17 Sep 2024 patches (vCenter 8.0 U3b, 7.0 U3s) are no longer recorded as First fix, because Broadcom later stated 'the vCenter patches released on September 17, 2024 did not fully address CVE-2024-38812' and released 'updated versions that contain additional fixes to fully address CVE-2024-38812' on 21 Oct 2024; they fixed CVE-2024-38813 but Broadcom did not present them as a mitigation for CVE-2024-38812.

First fix = Fixed for all versions = 21 Oct 2024, when complete fixes covered every line (8.0 U3d, new 8.0 U2e, 7.0 U3t, VCF via KB88287). exploited before a fix=false: exploitation was confirmed 18 Nov 2024, after the complete fix. On 20 Sep 2024 (VMSA-2024-0019.1) Broadcom warned that the 8.0 U3b update 'may introduce a functional issue' (KB377734).

In-product workarounds 'were determined to not be viable'.

Related

Broadcom (VMware) report card