Workaround Instructions for CVE-2021-22040 and CVE-2021-22041

Products

• VMware Desktop Hypervisor
• VMware vSphere ESXi

Issue/Introduction

VMware has investigated CVE-2021-22040 and CVE-2021-22041 and has determined that the possibility of exploitation can be removed by performing the steps detailed in the Workaround section of this article.

This workaround is meant to be a temporary solution until updates documented in VMSA-2022-0004 can be deployed.
 

Environment

VMware Workstation Pro 16.x (Windows)
VMware vSphere ESXi 6.7
VMware vSphere ESXi 6.5
VMware vSphere ESXi 7.0.0
VMware Workstation Pro 16.x (Linux)
VMware Fusion 12.x

Resolution

Resolution is documented in VMware ESXi Updates For VMSA-2022-0004

For details on the VMware ESXi fixes available, please see https://knowledge.broadcom.com/external/article/317663/vmware-esxi-updates-for-vmsa20220004.html

Workaround:

The workaround for both CVE-2021-22040 and CVE-2021-22041 is to remove all USB controllers from the Virtual Machine. As a result, USB pass through functionality will be unavailable.

In addition, virtual/emulated USB devices, such as VMware virtual USB stick or dongle will not be available for use by the virtual machine while the default keyboard/mouse as input devices are not affected as they are per default not connected through USB protocol but have a driver that does software device emulation in the guest OS.

IMPORTANT:
Certain guest operating systems, including Mac OS do not support using a PS/2 mouse and keyboard. Without a USB controller. these guest operating systems will be left without a mouse and keyboard.

The procedure for removing the virtual USB controllers for the affected products is described here:

• VMware ESXi:
  https://knowledge.broadcom.com/external/article/315467/steps-to-remove-a-usb-controller-from-a.html
   

• VMware Workstation Pro:
  https://techdocs.broadcom.com/us/en/vmware-cis/desktop-hypervisors/workstation-pro/17-0/using-vmware-workstation-pro/configuring-virtual-machine-hardware-settings/removing-hardware-from-a-virtual-machine.html
   

• VMware Workstation Player:
  https://knowledge.broadcom.com/external/article/315640/removing-unnecessary-hardware-from-vmwar.html#:~:text=To%20remove%20hardware%20from%20a,devices%20from%20a%20virtual%20machine.&text=Note%3A%20You%20cannot%20remove%20hardware,while%20it%20is%20in%20suspended.
   

• VMware Fusion:
  https://knowledge.broadcom.com/external/article/332353/remove-the-usb-controller-on-vmware-work.html