Broadcom Fails to Disclose Zero-Day Exploitation of VMware Vulnerability

According to the discoverer, NVISO: “We can however not assess whether this exploit was part of UNC5174’s capabilities or whether the zero-day’s usage was merely accidental due to its trivialness.”

This may explain the failure to notify of a 0day, since it seemed to be exploited accidentally in the course of a more sophisticated operation.

But that doesn’t excuse the lack of disclosure IMO. If it’s so trivial you could accidentally exploit it, seems bad.

Good reason as to why even in vms, services should be containerized such as with nspawn, ideally distroless if sanely doable for the service.

Not that containerization should be your only protection either, but generally I prefer random users not to have opportunity to just create and run arbitrary executables in default namespace.

To add an insult to the injury, Broadcom totally wrecked the update process for existing VMware installations. They killed update servers and domains, everything is annihilated.

A cherry on the top: you need to pass a quest of registrations and approvals before you ever be able to have an opportunity to get access to any VMware software download. Good luck updating your software, folks.

That's going to cost them big time in the EU when the CRA goes into full effect in a couple years. Theoretically anyway.