PT-2023-6346 · Vmware · Vmware Fusion

Patch1T · Published 2023-10-20 · Updated 2025-03-07 · CVE-2023-34046

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VMware Fusion versions 13.x prior to 13.5

Description The issue is related to a Time-of-check Time-of-use (TOCTOU) vulnerability in VMware Fusion. This vulnerability can be exploited by a malicious actor with local non-administrative user privileges to escalate privileges to root on the system where Fusion is installed or being installed for the first time. The vulnerability occurs during the initial installation of VMware Fusion, when the user needs to drag or copy the application to a folder from the '.dmg' volume, or when installing an upgrade.

Recommendations For versions 13.x prior to 13.5, update to version 13.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the system during the installation process to minimize the risk of exploitation.

Fix

Time Of Check To Time Of Use

Weakness Enumeration

CWE-264

CWE-367

Related Identifiers

BDU:2023-07058

CVE-2023-34046

Affected Products

Vmware Fusion

References · 12

• https://vmware.com/security/advisories/VMSA-2023-0022.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07058 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-34046 · Security Note
• https://osv.dev/vulnerability/CVE-2023-34046 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1715314507004641686 · Twitter Post
• https://t.me/cibsecurity/72659 · Telegram Post
• https://twitter.com/CVEnew/status/1715298592196637132 · Twitter Post
• https://vuldb.com/?id.243040 · Note
• https://t.me/cvenotify/113903 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2023102009 · Note
• https://twitter.com/nish/status/1715282904765321255 · Twitter Post
• https://t.me/cvenotify/60123 · Telegram Post