Broadcom-owned VMware on Tuesday rolled out critical-severity patches to cover a pair of vulnerabilities in its vCenter Server platform and warned that there’s a major risk of remote code execution attacks.

The most severe of the two, tagged as CVE-2024-38812, is documented as a heap-overflow in the Distributed Computing Environment / Remote Procedure Call (DCERPC) protocol implementation within vCenter Server. 

VMware warned that an attacker with network access to the server could send a specially crafted packet to execute remote code.  The flaw carries a CVSS severity score of 9.8/10.

The second bug — CVE-2024-38813 — is described as a privilege escalation vulnerability with a maximum CVSS severity score of 7.5/10.  “A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet,” the company said.

The vulnerabilities impact VMware vCenter Server versions 7.0 and 8.0, as well as VMware Cloud Foundation versions 4.x and 5.x. VMware has provided fixed versions (vCenter Server 8.0 U3b and 7.0 U3s) and patches for Cloud Foundation users. No workarounds have been found for either vulnerability, making patching the only viable solution.

VMware credited the discovery of the issues to research teams participating in the 2024 Matrix Cup, a prominent hacking contest in China that harvests zero-days in major OS platforms, smartphones, enterprise software, browsers, and security products. 

The Matrix Cup competition took place in June this year and is sponsored by Chinese cybersecurity firm Qihoo 360 and Beijing Huayun’an Information Technology.  

Chinese law dictates that zero-day vulnerabilities found by citizens must be promptly disclosed to the government. The details of a security hole cannot be sold or provided to any third-party, apart from the product’s manufacturer. The cybersecurity industry has raised concerns that the law will help the Chinese government stockpile zero-days. 

Indeed, one year after the law came into effect, Microsoft said it had contributed to a zero-day exploit surge. Threat actors believed to be sponsored by the Chinese government regularly leverage zero-day vulnerabilities in their attacks, including against the US government and affiliated entities. 

Zero-day vulnerabilities in VMware vCenter have been exploited in the past by Chinese-linked APT groups.

Related: Chinese Spies Exploited VMware vCenter Server Vulnerability Since 2021

Related: $2.5 Million Offered at Upcoming ‘Matrix Cup’ Chinese Hacking Contest 

Related: Microsoft Says Ransomware Gangs Exploiting VMware ESXi Flaw

Related: Exploit Code Published for Critical-Severity VMware Security Defect

Related: VMware Confirms Live Exploits Hitting Just-Patched Security Flaw