vCenter DCERPC Out-of-Bounds Write (2023)
- Product
- VMware vCenter Server
- CVE
- CVE-2023-34048
- Disclosed
- 2023-10-25
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- vCenter Server 7.0 and 8.0 (plus out-of-support 6.5, 6.7, 5.x) before fixed builds; Cloud Foundation 4.x/5.x.
- Fixed
- vCenter 7.0 U3o, 8.0 U1d, 8.0 U2 (VMSA-2023-0023); patches also released for EOL 6.7U3, 6.5U3, VCF 3.x.
Summary
A memory-corruption bug in vCenter's implementation of the DCERPC protocol. Mandiant later found the Chinese espionage group UNC3886 had been exploiting it as a zero-day since late 2021 to deploy backdoors on ESXi hosts.
Root cause
vCenter's implementation of the DCE/RPC protocol (used by services such as vmdird; exposed on TCP/2012, 2014, 2020) performs an out-of-bounds write while parsing crafted RPC packets, letting an unauthenticated network attacker corrupt memory and execute code.
Impact
Unauthenticated RCE on vCenter, leading to control of the entire vSphere estate.
Detection
Look in /var/log/vMonCoredumper.log for 'vmdird' crash/core-dump entries; Mandiant saw these minutes before backdoors were deployed, with the core dumps themselves deleted by the attacker. Check vCenter build numbers against VMSA-2023-0023.
Mitigation
Upgrade; there is no workaround other than strict network-perimeter controls on vCenter management ports (2012/2014/2020).