VMSA-2022-0002:VMware Workstation and Horizon Client for Windows updates address a denial-of-service vulnerability

Product/Component

VMware Desktop Hypervisor

0 more products

Notification Id

23628

Last Updated

16 January 2022

Initial Publication Date

16 January 2022

Status

CLOSED

Severity

MEDIUM

CVSS Base Score

4.0

WorkAround

Affected CVE

CVE-2022-22938

Advisory ID: VMSA-2022-0002

CVSSv3 Range: 4.0

Issue Date:2022-01-18

Updated On: 2022-01-18 (Initial Advisory)

CVE(s): CVE-2022-22938

Synopsis: VMware Workstation and Horizon Client for Windows updates address a denial-of-service vulnerability (CVE-2022-22938)

1. Impacted Products

VMware Workstation Pro / Player (Workstation)
VMware Horizon Client for Windows

2. Introduction

A denial-of-service vulnerability in VMware Workstation and Horizon Client for Windows was privately reported to VMware. Updates are available to remediate this vulnerability in affected VMware products.

3. Denial-of-service vulnerability via Cortado ThinPrint (CVE-2022-22938)

Description

VMware Workstation and Horizon Client for Windows contains a denial-of-service vulnerability in the Cortado ThinPrint component. The issue exists in the TrueType font parser. VMware has evaluated the severity of the issue to be in the Moderate severity range with a CVSSv3 base score of 4.0.

Known Attack Vectors

A malicious actor with access to a virtual machine or remote desktop may exploit this issue to trigger a denial-of-service condition in the Thinprint service running on the host machine where VMware Workstation or Horizon Client for Windows is installed.

Resolution

To remediate CVE-2022-22938 apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' found below.

Workarounds

None.

Additional Documentation

None.

Notes

Exploitation is only possible if virtual printing has been enabled. This feature is not enabled by default on Workstation but it is enabled by default on Horizon Client for Windows.

Acknowledgements

VMware would like to thank Gabriel Durdiak, a former intern of Quarkslab for reporting this issue to us.

Response Matrix

Product	Version	Running On	CVE Identifier	CVSSv3	Severity	Fixed Version	Workarounds	Additional Documentation
Workstation	16.x	Windows	CVE-2022-22938	4.0	moderate	16.2.2	None	None
Horizon Client for Windows	5.x	Windows	CVE-2022-22938	4.0	moderate	5.5.3	None	None