According to the CVSS Metric, the attack complexity is high (AC:H). What does that mean for this vulnerability? Successful exploitation of this vulnerability would rely upon complex memory shaping techniques to attempt an attack. According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability? This vulnerability could lead to a contained execution environment escape. Please refer to AppContainer Isolation for more information. According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution? The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. The vulnerable endpoint is only available over the local VM interface as all external communication is blocked. This means an attacker needs to execute code from the local machine to exploit the vulnerability. According to the CVSS metric, privileges required is low (PR:L). Does the attacker need to be in an authenticated role on the Virtual Trusted Platform Module? Yes, the attacker must be authenticated as a guest mode user to escape the virtual machine.
<a href="https://twitter.com/rthhh17">HongZhenhao</a> with <a href="https://twitter.com/tiangonglab">TianGong Team of Legendsec at Qi'anxin Group</a>