Vulnerability · Published Aug 23, 2022 · Assigned by vmware
CVE-2022-31676
High 7.8
In plain English
A high-severity security flaw in VMware Tools. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.8High
Exploit odds (30 days)0.5%top 54.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
VMware Tools (12.0.0, 11.x.y and 10.x.y) contains a local privilege escalation vulnerability. A malicious actor with local non-administrative access to the Guest OS can escalate privileges as a root user in the virtual machine.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | open-vm-tools | 11.3.5-1.el8_6.1 | ALSA-2022:6357 |
| AlmaLinux:9 | open-vm-tools | 11.3.5-1.el9_0.1 | ALSA-2022:6358 |
| AlmaLinux:8 | open-vm-tools-desktop | 11.3.5-1.el8_6.1 | ALSA-2022:6357 |
| AlmaLinux:9 | open-vm-tools-desktop | 11.3.5-1.el9_0.1 | ALSA-2022:6358 |
| AlmaLinux:8 | open-vm-tools-sdmp | 11.3.5-1.el8_6.1 | ALSA-2022:6357 |
| AlmaLinux:9 | open-vm-tools-sdmp | 11.3.5-1.el9_0.1 | ALSA-2022:6358 |
| AlmaLinux:9 | open-vm-tools-test | 11.3.5-1.el9_0.1 | ALSA-2022:6358 |
| Alpine:v3.20 | open-vm-tools | 12.1.0-r0 | ALPINE-CVE-2022-31676 |
| Alpine:v3.21 | open-vm-tools | 12.1.0-r0 | ALPINE-CVE-2022-31676 |
| Alpine:v3.22 | open-vm-tools | 12.1.0-r0 | ALPINE-CVE-2022-31676 |
| Alpine:v3.23 | open-vm-tools | 12.1.0-r0 | ALPINE-CVE-2022-31676 |
| Alpine:v3.24 | open-vm-tools | 12.1.0-r0 | ALPINE-CVE-2022-31676 |
| Debian:12 | open-vm-tools | 2:12.1.0-1 | DEBIAN-CVE-2022-31676 |
| Debian:13 | open-vm-tools | 2:12.1.0-1 | DEBIAN-CVE-2022-31676 |
| Debian:14 | open-vm-tools | 2:12.1.0-1 | DEBIAN-CVE-2022-31676 |
| Rocky Linux:8 | open-vm-tools | 0:11.3.5-1.el8_6.1 | RLSA-2022:6357 |
| Rocky Linux:9 | open-vm-tools | 0:11.3.5-1.el9_0.1 | RLSA-2022:6358 |
| Ubuntu:22.04:LTS | open-vm-tools | 2:11.3.5-1ubuntu4.1 | UBUNTU-CVE-2022-31676 |
| Ubuntu:22.04:LTS | open-vm-tools | 2:11.3.5-1ubuntu4.1 | USN-5578-1 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | VMware Tools | VMware Tools (12.0.0, 11.x.y and 10.x.y) |
References
- https://www.vmware.com/security/advisories/VMSA-2022-0024.html
- [oss-security] 20220823 [SECURITY ADVISORY] open-vm-tools: Local privilege escalation vulnerability (CVE-2022-31676) mailing-list
- DSA-5215 vendor-advisory
- [debian-lts-announce] 20220825 [SECURITY] [DLA 3081-1] open-vm-tools security update mailing-list
- FEDORA-2022-cd23eac6f4 vendor-advisory
- FEDORA-2022-1b8d3b2845 vendor-advisory
- FEDORA-2022-1c9c0bacaf vendor-advisory
- https://security.netapp.com/advisory/ntap-20221017-0003/
- GLSA-202210-27 vendor-advisory