VMSA-2022-0024:VMware Tools update addresses a local privilege escalation vulnerability
1. Impacted Products
- VMware Tools
2. Introduction
VMware Tools was impacted by a local privilege escalation vulnerability. Updates are available to remediate this vulnerability in affected VMware products.
3. Local privilege escalation vulnerability (CVE-2022-31676)
Description
VMware Tools contains a local privilege escalation vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.0.
Known Attack Vectors
A malicious actor with local non-administrative access to the Guest OS can escalate privileges as a root user in the virtual machine.
Resolution
To remediate CVE-2022-31676 apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' found below.
Workarounds
None.
Additional Documentation
None.
Notes
- 2022/08/23: VMware Tools 10.3.25 only applies to the older Linux releases.
- 2022/09/02: A version of open-vm-tools that addresses CVE-2022-31676 will be distributed by Linux vendors.
- 2022/09/02: ** - Fixed version may differ based on the Linux distribution version and the distribution vendor.
Acknowledgements
None.
Response Matrix
| Product | Version | Running On | CVE Identifier | CVSSv3 | Severity | Fixed Version | Workarounds | Additional Documentation |
| VMware Tools | 12.x.y, 11.x.y and 10.x.y | Windows | CVE-2022-31676 | important | None | None | ||
| VMware Tools (open-vm-tools) | 12.x.y, 11.x.y and 10.x.y | Linux | CVE-2022-31676 | important | 12.1.0** | None | None | |
| VMware Tools | 10.x.y | Linux | CVE-2022-31676 | important | None | None |
4. References
Fixed Version(s) and Release Notes:
VMware Tools for Windows 12.1.0
Downloads and Documentation:
https://docs.vmware.com/en/VMware-Tools/12.1/rn/VMware-Tools-1210-Release-Notes.html
VMware Tools for Linux 10.3.25
Downloads and Documentation:
https://docs.vmware.com/en/VMware-Tools/10.3/rn/VMware-Tools-10325-Release-Notes.html
Mitre CVE Dictionary Links:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31676
FIRST CVSSv3 Calculator:
CVE-2022-31676: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
5. Change Log
2022-08-23 VMSA-2022-0024
Initial security advisory.
2022-09-02 VMSA-2022-0024.1
Updated security advisory response matrix impacted products and added a note for open-vm-tools.
6. Contact
E-mail list for product security notifications and announcements:
https://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
E-mail: [email protected]
PGP key at:
VMware Security Advisories
https://www.vmware.com/security/advisories
VMware Security Response Policy
https://www.vmware.com/support/policies/security_response.html
VMware Lifecycle Support Phases
https://www.vmware.com/support/policies/lifecycle.html
VMware Security & Compliance Blog
https://blogs.vmware.com/security
Copyright 2022 VMware Inc. All rights reserved.