CVE-2024-38813
VMware vCenter Server Privilege Escalation Vulnerability
Description
CVE-2024-38813 is a high-severity privilege escalation vulnerability in VMware vCenter Server, the centralized management platform for VMware virtualized environments. A malicious actor with network access to vCenter Server can exploit this flaw to escalate privileges to root by sending a specially crafted network packet. With a CVSS v3.1 base score of 7.5, the vulnerability affects vCenter Server versions 7.0 and 8.0 as well as VMware Cloud Foundation versions 4.0 through 5.2. CISA has added CVE-2024-38813 to the Known Exploited Vulnerabilities catalog with a remediation deadline of December 11, 2024, and its EPSS score of 31.11% at the 96.6th percentile indicates an exceptionally high probability of active exploitation in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| vmware | cloud foundation | >= 4.0, < 5.2 |
| vmware | vcenter server | 7.0; 8.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
Weakness Type
Privilege Escalation via Crafted Network Packet
CVE-2024-38813 is a privilege escalation vulnerability in VMware vCenter Server where a low-privileged authenticated user with network access can elevate their privileges to root. The weakness arises from improper handling of specially crafted network packets that bypass the authorization mechanisms within vCenter Server. When the server processes these malformed packets, it fails to properly enforce privilege boundaries, allowing the attacker's session to inherit root-level permissions. This type of weakness is particularly dangerous in centralized management platforms because root access to vCenter Server grants full control over all managed ESXi hosts, virtual machines, and the broader virtualized infrastructure.
Impact Analysis
The impact of CVE-2024-38813 is severe across all three dimensions of the CIA triad, though the attack complexity is high (AC:H), which slightly reduces the overall base score. Confidentiality is fully compromised because root access to vCenter Server exposes all managed infrastructure credentials, virtual machine configurations, encryption keys, and sensitive operational data stored within the vCenter database. Attackers with root privileges can access vSphere client sessions, extract stored credentials for ESXi hosts, and read any data within the managed virtualized environment.
Integrity faces maximum impact as root-level access enables the attacker to modify any configuration within the vCenter environment, including virtual machine settings, network configurations, access controls, and audit logs. An attacker could deploy malicious virtual machines, alter security policies, inject backdoors into the management infrastructure, or tamper with backup configurations to ensure persistent access.
Availability is critically at risk since root access allows the attacker to shut down or disrupt the entire virtualized environment managed by vCenter Server. This includes the ability to power off virtual machines, disconnect storage, modify resource pools, or corrupt the vCenter database itself. The EPSS score of 31.11% at the 96.6th percentile reflects the high likelihood of exploitation, and the ransomware association remains unknown but the infrastructure-level access makes this vulnerability particularly attractive to ransomware operators seeking maximum leverage.
Exploit Maturity
CVE-2024-38813 exhibits very high exploit maturity, confirmed by its inclusion in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of December 11, 2024. The EPSS score of 31.11% at the 96.6th percentile places it among the top 3.4% of all vulnerabilities in terms of exploitation probability, indicating widespread targeting by threat actors.
Broadcom has published a security advisory (VMSA-2024-0019) detailing the vulnerability and providing patch information. This vulnerability is particularly noteworthy because it was disclosed alongside CVE-2024-38812, a critical heap-overflow vulnerability in the same product, suggesting that attackers may chain both vulnerabilities for maximum impact. While CISA's ransomware classification for this CVE is listed as unknown, the ability to gain root access to VMware vCenter Server makes it an extremely valuable target for advanced persistent threat groups and ransomware operators who seek to compromise entire virtualized environments in a single attack chain.
Remediation
-
Apply vendor patches immediately. Upgrade VMware vCenter Server to the latest patched versions as specified in Broadcom's security advisory VMSA-2024-0019. For vCenter Server 7.0 and 8.0, apply the respective updates provided by Broadcom. For VMware Cloud Foundation versions 4.0 through 5.2, follow the Cloud Foundation-specific patching guidance.
-
Restrict network access to vCenter Server. Ensure that vCenter Server management interfaces are not exposed to untrusted networks. Implement firewall rules and network segmentation to limit access to authorized administrators and management subnets only. Use a dedicated management VLAN isolated from general user traffic.
-
Audit privileged accounts and sessions. Review all accounts with access to vCenter Server, remove any unnecessary privileges, and investigate any suspicious activity in vCenter audit logs. Check for unauthorized changes to roles, permissions, or configurations that may indicate prior exploitation.
-
Monitor for indicators of compromise. Examine vCenter Server logs for unusual authentication events, privilege changes, or unexpected network connections. Deploy network monitoring to detect anomalous traffic patterns targeting vCenter Server ports and services.
-
Implement defense-in-depth measures. Enable VMware's built-in security hardening features, enforce multi-factor authentication for vCenter access, and ensure that backup and disaster recovery procedures are current in case rollback is required after a compromise.
Technical Details
CVE-2024-38813 is a privilege escalation vulnerability in VMware vCenter Server with a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, resulting in a base score of 7.5. The vector breakdown reveals that the attack is network-accessible (AV:N) but requires high attack complexity (AC:H), meaning specific conditions must be met for successful exploitation. The attacker needs low-level privileges (PR:L), indicating that some form of authenticated access to vCenter Server is required before the escalation can occur. No user interaction (UI:N) is needed beyond the attacker sending the crafted packet.
The vulnerability resides in the way vCenter Server processes certain network packets. When a specially crafted packet is received by the vCenter Server service, the processing logic fails to properly validate the authorization context of the requesting session. This allows a low-privileged user to manipulate the packet in a way that causes the server to execute subsequent operations with root-level privileges rather than the user's assigned privilege level.
The scope is unchanged (S:U), meaning the vulnerability affects only the vCenter Server component itself, though the practical impact extends to all infrastructure managed by that vCenter instance. Impact ratings are high across confidentiality (C:H), integrity (I:H), and availability (A:H), reflecting that root access provides complete control over the vCenter Server. Affected products include VMware vCenter Server versions 7.0 and 8.0, and VMware Cloud Foundation versions 4.0 through but not including 5.2.
Frequently Asked Questions
What is CVE-2024-38813?
CVE-2024-38813 is a privilege escalation vulnerability in VMware vCenter Server that allows an authenticated attacker with network access to escalate privileges to root by sending a specially crafted network packet. It carries a CVSS v3.1 score of 7.5 (High).
How does CVE-2024-38813 relate to CVE-2024-38812?
Both vulnerabilities were disclosed together in Broadcom's VMSA-2024-0019 advisory and affect the same versions of VMware vCenter Server. CVE-2024-38812 is a critical heap-overflow vulnerability that enables remote code execution, while CVE-2024-38813 enables privilege escalation to root. Attackers may chain both vulnerabilities to achieve unauthenticated remote root access.
Which VMware products are affected by CVE-2024-38813?
VMware vCenter Server versions 7.0 and 8.0 are affected, as well as VMware Cloud Foundation versions 4.0 through 5.2. Organizations should apply the patches specified in Broadcom's security advisory.
Is CVE-2024-38813 being exploited in ransomware attacks?
CISA classifies the ransomware association as unknown for this specific CVE. However, root access to vCenter Server provides attackers with control over entire virtualized environments, making it a high-value target for ransomware operators seeking to encrypt virtual machine disk files across multiple hosts simultaneously.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.