Headline
RHSA-2022:6356: Red Hat Security Advisory: open-vm-tools security update
An update for open-vm-tools is now available for Red Hat Enterprise Linux 8.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
Related CVEs:
- CVE-2022-31676: open-vm-tools: local root privilege escalation in the virtual machine
Skip to navigation Skip to main content
Utilities
- Subscriptions
- Downloads
- Containers
- Support Cases
Infrastructure and Management
- Red Hat Enterprise Linux
- Red Hat Virtualization
- Red Hat Identity Management
- Red Hat Directory Server
- Red Hat Certificate System
- Red Hat Satellite
- Red Hat Subscription Management
- Red Hat Update Infrastructure
- Red Hat Insights
- Red Hat Ansible Automation Platform
Cloud Computing
- Red Hat OpenShift
- Red Hat CloudForms
- Red Hat OpenStack Platform
- Red Hat OpenShift Container Platform
- Red Hat OpenShift Data Science
- Red Hat OpenShift Online
- Red Hat OpenShift Dedicated
- Red Hat Advanced Cluster Security for Kubernetes
- Red Hat Advanced Cluster Management for Kubernetes
- Red Hat Quay
- Red Hat CodeReady Workspaces
- Red Hat OpenShift Service on AWS
Storage
- Red Hat Gluster Storage
- Red Hat Hyperconverged Infrastructure
- Red Hat Ceph Storage
- Red Hat OpenShift Data Foundation
Runtimes
- Red Hat Runtimes
- Red Hat JBoss Enterprise Application Platform
- Red Hat Data Grid
- Red Hat JBoss Web Server
- Red Hat Single Sign On
- Red Hat support for Spring Boot
- Red Hat build of Node.js
- Red Hat build of Thorntail
- Red Hat build of Eclipse Vert.x
- Red Hat build of OpenJDK
- Red Hat build of Quarkus
Integration and Automation
- Red Hat Process Automation
- Red Hat Process Automation Manager
- Red Hat Decision Manager
All Products
Issued:
2022-09-06
Updated:
2022-09-06
RHSA-2022:6356 - Security Advisory
- Overview
- Updated Packages
Synopsis
Important: open-vm-tools security update
Type/Severity
Security Advisory: Important
Red Hat Insights patch analysis
Identify and remediate systems affected by this advisory.
View affected systems
Topic
An update for open-vm-tools is now available for Red Hat Enterprise Linux 8.4 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Description
The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of guest operating system virtualization components that enhance performance and user experience of virtual machines.
Security Fix(es):
- open-vm-tools: local root privilege escalation in the virtual machine (CVE-2022-31676)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Products
- Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.4 x86_64
- Red Hat Enterprise Linux Server - AUS 8.4 x86_64
- Red Hat Enterprise Linux Server - TUS 8.4 x86_64
- Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.4 x86_64
Fixes
- BZ - 2118714 - CVE-2022-31676 open-vm-tools: local root privilege escalation in the virtual machine
Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.4
SRPM
open-vm-tools-11.2.0-2.el8_4.1.src.rpm
SHA-256: 562c57115edbe5d91d1560a27ce926d91757b776b2e5d07ee7d008d8c1ddfcfc
x86_64
open-vm-tools-11.2.0-2.el8_4.1.x86_64.rpm
SHA-256: 50ffde8f3125b9d2c10917dd9e872d46503902c7c156cd92819f454b4ac24be0
open-vm-tools-debuginfo-11.2.0-2.el8_4.1.x86_64.rpm
SHA-256: eb14170e9a702c65f911de24c0ca2c539d4fd20460357af651721bf394c327d8
open-vm-tools-debugsource-11.2.0-2.el8_4.1.x86_64.rpm
SHA-256: 80880b5beb9379a24350cbe84356e04f4370596c9dbb7c48e55c3f3fa190ccb8
open-vm-tools-desktop-11.2.0-2.el8_4.1.x86_64.rpm
SHA-256: 5c2e98fad0ff01749db678736d9c0bc2428cfc8f41c261e045da8cc892b0cb69
open-vm-tools-desktop-debuginfo-11.2.0-2.el8_4.1.x86_64.rpm
SHA-256: 32c38842cb04e0b1e0cb1ddb284833728d088a4a8ece4c3050e6fe3c1e5de280
open-vm-tools-sdmp-11.2.0-2.el8_4.1.x86_64.rpm
SHA-256: bea842ef0c0eef06841d69af2bb818c0fe0657d29414ead7ae3aea69a8a1bf2d
open-vm-tools-sdmp-debuginfo-11.2.0-2.el8_4.1.x86_64.rpm
SHA-256: de92ab4401b05e4250b2b54edbb0d9f131d15a95a76aa056680ade3584af4037
open-vm-tools-test-debuginfo-11.2.0-2.el8_4.1.x86_64.rpm
SHA-256: d9fdd0504029198ca8dd771e6f0114e254e00c67fc2f442707782925cb461395
Red Hat Enterprise Linux Server - AUS 8.4
SRPM
open-vm-tools-11.2.0-2.el8_4.1.src.rpm
SHA-256: 562c57115edbe5d91d1560a27ce926d91757b776b2e5d07ee7d008d8c1ddfcfc
x86_64
open-vm-tools-11.2.0-2.el8_4.1.x86_64.rpm
SHA-256: 50ffde8f3125b9d2c10917dd9e872d46503902c7c156cd92819f454b4ac24be0
open-vm-tools-debuginfo-11.2.0-2.el8_4.1.x86_64.rpm
SHA-256: eb14170e9a702c65f911de24c0ca2c539d4fd20460357af651721bf394c327d8
open-vm-tools-debugsource-11.2.0-2.el8_4.1.x86_64.rpm
SHA-256: 80880b5beb9379a24350cbe84356e04f4370596c9dbb7c48e55c3f3fa190ccb8
open-vm-tools-desktop-11.2.0-2.el8_4.1.x86_64.rpm
SHA-256: 5c2e98fad0ff01749db678736d9c0bc2428cfc8f41c261e045da8cc892b0cb69
open-vm-tools-desktop-debuginfo-11.2.0-2.el8_4.1.x86_64.rpm
SHA-256: 32c38842cb04e0b1e0cb1ddb284833728d088a4a8ece4c3050e6fe3c1e5de280
open-vm-tools-sdmp-11.2.0-2.el8_4.1.x86_64.rpm
SHA-256: bea842ef0c0eef06841d69af2bb818c0fe0657d29414ead7ae3aea69a8a1bf2d
open-vm-tools-sdmp-debuginfo-11.2.0-2.el8_4.1.x86_64.rpm
SHA-256: de92ab4401b05e4250b2b54edbb0d9f131d15a95a76aa056680ade3584af4037
open-vm-tools-test-debuginfo-11.2.0-2.el8_4.1.x86_64.rpm
SHA-256: d9fdd0504029198ca8dd771e6f0114e254e00c67fc2f442707782925cb461395
Red Hat Enterprise Linux Server - TUS 8.4
SRPM
open-vm-tools-11.2.0-2.el8_4.1.src.rpm
SHA-256: 562c57115edbe5d91d1560a27ce926d91757b776b2e5d07ee7d008d8c1ddfcfc
x86_64
open-vm-tools-11.2.0-2.el8_4.1.x86_64.rpm
SHA-256: 50ffde8f3125b9d2c10917dd9e872d46503902c7c156cd92819f454b4ac24be0
open-vm-tools-debuginfo-11.2.0-2.el8_4.1.x86_64.rpm
SHA-256: eb14170e9a702c65f911de24c0ca2c539d4fd20460357af651721bf394c327d8
open-vm-tools-debugsource-11.2.0-2.el8_4.1.x86_64.rpm
SHA-256: 80880b5beb9379a24350cbe84356e04f4370596c9dbb7c48e55c3f3fa190ccb8
open-vm-tools-desktop-11.2.0-2.el8_4.1.x86_64.rpm
SHA-256: 5c2e98fad0ff01749db678736d9c0bc2428cfc8f41c261e045da8cc892b0cb69
open-vm-tools-desktop-debuginfo-11.2.0-2.el8_4.1.x86_64.rpm
SHA-256: 32c38842cb04e0b1e0cb1ddb284833728d088a4a8ece4c3050e6fe3c1e5de280
open-vm-tools-sdmp-11.2.0-2.el8_4.1.x86_64.rpm
SHA-256: bea842ef0c0eef06841d69af2bb818c0fe0657d29414ead7ae3aea69a8a1bf2d
open-vm-tools-sdmp-debuginfo-11.2.0-2.el8_4.1.x86_64.rpm
SHA-256: de92ab4401b05e4250b2b54edbb0d9f131d15a95a76aa056680ade3584af4037
open-vm-tools-test-debuginfo-11.2.0-2.el8_4.1.x86_64.rpm
SHA-256: d9fdd0504029198ca8dd771e6f0114e254e00c67fc2f442707782925cb461395
Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.4
SRPM
open-vm-tools-11.2.0-2.el8_4.1.src.rpm
SHA-256: 562c57115edbe5d91d1560a27ce926d91757b776b2e5d07ee7d008d8c1ddfcfc
x86_64
open-vm-tools-11.2.0-2.el8_4.1.x86_64.rpm
SHA-256: 50ffde8f3125b9d2c10917dd9e872d46503902c7c156cd92819f454b4ac24be0
open-vm-tools-debuginfo-11.2.0-2.el8_4.1.x86_64.rpm
SHA-256: eb14170e9a702c65f911de24c0ca2c539d4fd20460357af651721bf394c327d8
open-vm-tools-debugsource-11.2.0-2.el8_4.1.x86_64.rpm
SHA-256: 80880b5beb9379a24350cbe84356e04f4370596c9dbb7c48e55c3f3fa190ccb8
open-vm-tools-desktop-11.2.0-2.el8_4.1.x86_64.rpm
SHA-256: 5c2e98fad0ff01749db678736d9c0bc2428cfc8f41c261e045da8cc892b0cb69
open-vm-tools-desktop-debuginfo-11.2.0-2.el8_4.1.x86_64.rpm
SHA-256: 32c38842cb04e0b1e0cb1ddb284833728d088a4a8ece4c3050e6fe3c1e5de280
open-vm-tools-sdmp-11.2.0-2.el8_4.1.x86_64.rpm
SHA-256: bea842ef0c0eef06841d69af2bb818c0fe0657d29414ead7ae3aea69a8a1bf2d
open-vm-tools-sdmp-debuginfo-11.2.0-2.el8_4.1.x86_64.rpm
SHA-256: de92ab4401b05e4250b2b54edbb0d9f131d15a95a76aa056680ade3584af4037
open-vm-tools-test-debuginfo-11.2.0-2.el8_4.1.x86_64.rpm
SHA-256: d9fdd0504029198ca8dd771e6f0114e254e00c67fc2f442707782925cb461395
The Red Hat security contact is [email protected]. More contact details at https://access.redhat.com/security/team/contact/.
Related news
Dell Unity 5.3 contain(s) an Arbitrary File Creation vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by crafting arbitrary files through a request to the server.
IBM Security Guardium 11.3, 11.4, and 11.5 could allow a local user to obtain elevated privileges due to incorrect authorization checks. IBM X-Force ID: 216753.
ISOS firmwares from versions 1.81 to 2.00 contain hardcoded credentials from embedded StreamX installer that integrators are not forced to change.
Gentoo Linux Security Advisory 202210-27 - A vulnerability has been discovered in open-vm-tools which could allow for local privilege escalation. Versions less than 12.1.0 are affected.
Red Hat Security Advisory 2022-6381-01 - The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of guest operating system virtualization components that enhance performance and user experience of virtual machines. Issues addressed include a privilege escalation vulnerability.
Red Hat Security Advisory 2022-6354-01 - The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of guest operating system virtualization components that enhance performance and user experience of virtual machines. Issues addressed include a privilege escalation vulnerability.
Red Hat Security Advisory 2022-6355-01 - The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of guest operating system virtualization components that enhance performance and user experience of virtual machines. Issues addressed include a privilege escalation vulnerability.
An update for open-vm-tools is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-31676: open-vm-tools: local root privilege escalation in the virtual machine
An update for open-vm-tools is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-31676: open-vm-tools: local root privilege escalation in the virtual machine
An update for open-vm-tools is now available for Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-31676: open-vm-tools: local root privilege escalation in the virtual machine
Ubuntu Security Notice 5578-2 - USN-5578-1 fixed a vulnerability in Open VM Tools. This update provides the corresponding update for Ubuntu 16.04 ESM. It was discovered that Open VM Tools incorrectly handled certain requests. An attacker inside the guest could possibly use this issue to gain root privileges inside the virtual machine.
An insider threat or remote attacker with initial access could exploit CVE-2022-31676 to steal sensitive data and scoop up user credentials for follow-on attacks.
Ubuntu Security Notice 5578-1 - It was discovered that Open VM Tools incorrectly handled certain requests. An attacker inside the guest could possibly use this issue to gain root privileges inside the virtual machine.
VMware Tools (12.0.0, 11.x.y and 10.x.y) contains a local privilege escalation vulnerability. A malicious actor with local non-administrative access to the Guest OS can escalate privileges as a root user in the virtual machine.