vCenter DCERPC Heap Overflow (2024)
- Product
- VMware (Broadcom) vCenter Server
- CVE
- CVE-2024-38812
- Disclosed
- 2024-09-17
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- vCenter Server 7.0 and 8.0; VMware Cloud Foundation 4.x/5.x.
- Fixed
- vCenter 8.0 U3d, 8.0 U2e, 7.0 U3t (VMSA-2024-0019, updated October 2024 after the initial September patch proved incomplete).
Summary
A heap overflow in vCenter's DCERPC implementation demonstrated at China's 2024 Matrix Cup contest by zbl & srs of team TZL. Broadcom's first patch did not fully fix it, and in November 2024 Broadcom confirmed exploitation in the wild.
Root cause
Insufficient bounds checking while parsing DCE/RPC protocol data in vCenter allows a crafted network packet to overflow a heap buffer, corrupting adjacent memory and enabling code execution without authentication.
Impact
Unauthenticated RCE on vCenter Server.
Detection
Verify vCenter builds against VMSA-2024-0019 (note the September builds 8.0 U3b / 7.0 U3s are still vulnerable). Monitor for vCenter service crashes and anomalous DCERPC traffic.
Mitigation
Upgrade to the October 2024 builds; restrict network access to vCenter management interfaces.