VMware Multiple Products Privilege Escalation Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2021-11-03

[ Description ]Official description

VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0) contain a privilege escalation vulnerability due to improper use of setuid binaries. Successful exploitation of this issue may allow attackers with normal user privileges to escalate their privileges to root on the system where Fusion, VMRC or Horizon Client is installed.

CISA: VMware Fusion, Remote Console (VMRC) for Mac, and Horizon Client for Mac contain a privilege escalation vulnerability due to improper use of setuid binaries that allows attackers to escalate privileges to root.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 3 May 2022): Apply updates per vendor instructions.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• packetstormsecurity.com/files/156843/VMware-Fusion-11.5.2-Privilege-Escalation.htmlExploitThird Party AdvisoryVDB Entry
• packetstormsecurity.com/files/157079/VMware-Fusion-USB-Arbitrator-Setuid-Privilege-Esca…ExploitThird Party AdvisoryVDB Entry
• www.vmware.com/security/advisories/VMSA-2020-0005.htmlVendor Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource