[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <CADOAh9cRx64wR8a7X7918ma_nkYDXzQ8uK6Jsp0q4oe-ECr3Eg@mail.gmail.com>
Date: Mon, 12 May 2025 18:57:46 +0530
From: VMware PSIRT <vmware.psirt@...adcom.com>
To: oss-security@...ts.openwall.com
Subject: CVE-2025-22247 - Insecure file handling vulnerability in open-vm-tools
Description
==============================================================
CVE-2025-22247: open-vm-tools contains an insecure file handling
vulnerability. VMware has evaluated the severity of this issue to be in the
Moderate severity range with a maximum CVSSv3 base score of 6.1 -
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N.
Known Attack Vectors
==============================================================
A malicious actor with non-administrative privileges on a guest VM may
tamper the local files to trigger insecure file operations within that VM.
Remediation
==============================================================
The following patches are provided for released versions of open-vm-tools:
https://github.com/vmware/open-vm-tools/tree/CVE-2025-22247.patch
The patches have been tested against the above open-vm-tools releases. Each
applies cleanly with:
git am for a git repository.
patch -p2 in the top directory of an open-vm-tools source tree.
==============================================================
------
Thanks,
Praveen Singh
Broadcom PSIRT - VCF Division
vmware.psirt@...adcom.com
--
This electronic communication and the information and any files transmitted
with it, or attached to it, are confidential and are intended solely for
the use of the individual or entity to whom it is addressed and may contain
information that is confidential, legally privileged, protected by privacy
laws, or otherwise restricted from disclosure to anyone else. If you are
not the intended recipient or the person responsible for delivering the
e-mail to the intended recipient, you are hereby notified that any use,
copying, distributing, dissemination, forwarding, printing, or copying of
this e-mail is strictly prohibited. If you received this e-mail in error,
please return the e-mail to the sender, delete it from your computer, and
destroy any printed copy of it.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
