Coverage › CVE-2025-22224

CVE-2025-22224 Mapped Sigma

VMware ESXi and Workstation TOCTOU Race Condition Vulnerability

Vendor / product

VMware — ESXi and Workstation

Description (CISA)

VMware ESXi and Workstation contain a time-of-check time-of-use (TOCTOU) race condition vulnerability that leads to an out-of-bounds write. Successful exploitation enables an attacker with local administrative privileges on a virtual machine to execute code as the virtual machine's VMX process running on the host.

Added to KEV

2025-03-04

Due date

2025-03-25

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Known ransomware use

Unknown

CWE

CWE-367

CISA notes

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390
https://nvd.nist.gov/vuln/detail/CVE-2025-22224

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

2 mapping objects across 2 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1055 Process Injection exploitation technique

• DET0508 Behavioral Detection of Process Injection Across Platforms
  AN1399 Windows

  Detects process injection by correlating memory manipulation API calls (e.g., VirtualAllocEx, WriteProcessMemory), suspicious thread creation (e.g., CreateRemoteThread), and unusual DLL loads within another process's context.

  WinEventLog:Sysmon EventCode=10 → DC0035 Process Access

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=7 → DC0016 Module Load

  etw:Microsoft-Windows-Kernel-Process API calls → DC0021 OS API Execution

  Tunable: AccessMask TimeWindow InjectedProcessList
  AN1400 Linux

  Detects ptrace- or memfd-based process injection through audit logs capturing system calls (e.g., ptrace, mmap) targeting running processes along with suspicious file descriptors or memory writes.

  auditd:SYSCALL ptrace, mmap, process_vm_writev → DC0021 OS API Execution

  auditd:SYSCALL open → DC0055 File Access

  linux:procfs /proc/[pid]/maps, /proc/[pid]/mem → DC0020 Process Modification

  Tunable: TargetPIDThreshold TimeWindow
  AN1401 macOS

  Detects memory-based injection by monitoring task_for_pid, mach_vm_write, and dylib injection patterns through DYLD_INSERT_LIBRARIES or manual memory mapping.

  macos:unifiedlog subsystem=com.apple.security, library=libsystem_kernel.dylib → DC0035 Process Access

  macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_EXEC, ES_EVENT_TYPE_NOTIFY_MMAP → DC0034 Process Metadata

  macos:syslog DYLD_INSERT_LIBRARIES anomalies → DC0016 Module Load

  Tunable: TargetProcessSignature MachSyscallContext

Sigma rules tagged attack.t1055 (37)

All 37 rules on the technique page →

T1611 Escape to Host primary impact

• DET0219 Detection Strategy for Escape to Host
  AN0612 Containers

  Detection of container escape attempts via bind mounts, privileged containers, or abuse of docker.sock. Defenders may observe anomalous volume mount configurations (e.g., hostPath to / or /proc), unexpected privileged container launches, or use of container administration commands to access host resources. These events typically correlate with subsequent process execution on the host outside of normal container isolation.

  docker:daemon container create/start with privileged flag or host volume mount → DC0072 Container Creation

  kubernetes:apiserver Pod spec with hostPath or privileged securityContext → DC0092 Volume Modification

  Tunable: AllowedHostPaths PrivilegedContainerThreshold
  AN0613 Linux

  Detection of Linux container escape attempts via syscalls (unshare, keyctl, mount) or process execution outside container namespaces. Defenders may correlate unusual system calls from containerized processes with subsequent process creation on the host or modification of host resources.

  auditd:SYSCALL unshare, mount, keyctl, setns syscalls executed by containerized processes → DC0021 OS API Execution

  linux:Sysmon process creation events linked to container namespaces executing host-level binaries → DC0032 Process Creation

  Tunable: SyscallWhitelist TimeWindow
  AN0614 Windows

  Detection of Windows container escape attempts by observing processes accessing host directories, symbolic link abuse, or privilege escalation attempts. Defenders may detect anomalous process execution with access to system-level directories outside of container boundaries.

  WinEventLog:Security EventCode=4688 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  Tunable: RestrictedHostDirs
  AN0615 ESXi

  Detection of ESXi escape attempts by monitoring for anomalies in hypervisor logs such as unexpected VM operations, privilege escalation events, or attempts to load malicious kernel modules within the hypervisor environment.

  esxi:vmkernel VM exit/entry anomalies, unexpected hypercalls, or kernel module loading → DC0031 Kernel Module Load

  Tunable: AllowedKernelModules

Sigma rules tagged attack.t1611 (2)