PT-2025-39834 · Vmware +5 · Vmware Tools +6

Maxime Thiebaut · Published 2025-01-01 · Updated 2025-10-16 · CVE-2025-41244

Positive Technologies · (AI Summary)

CVSS v3.1

7.8

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VMware Aria Operations and VMware Tools versions prior to fixes available since October 2024 open-vm-tools versions prior to 2:11.3.0-2ubuntu0~ubuntu20.04.8+esm1 VMware Cloud Foundation 4.x and 5.x, 9.xxx, 13.xxx vSphere Foundation 9.xxx, 13.xxx Telco Cloud Platform 4.x and 5.x Telco Cloud Infrastructure 2.x and 3.x

Description VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. This flaw allows a malicious local actor with non-administrative privileges to escalate privileges to root on the same VM. The vulnerability is related to improper handling of regular expressions in the

get version()

function within VMware Tools and Aria Operations. Specifically, the use of overly permissive regular expressions allows for the execution of arbitrary binaries in directories accessible to non-privileged users, such as /tmp/httpd. This vulnerability has been actively exploited in the wild by the UNC5174 threat actor since October 2024. The vulnerability impacts VMware Cloud Foundation, vSphere Foundation, Telco Cloud Platform, and Telco Cloud Infrastructure. The

SDMP get-versions.sh

script is also affected.

Recommendations Update VMware Aria Operations and VMware Tools to the latest available versions. Update open-vm-tools to version 2:11.3.0-2ubuntu0~ubuntu20.04.8+esm1 or later. Disable the SDMP functionality if patching is not immediately feasible. Monitor systems for suspicious activity, including the creation of unexpected binaries in /tmp/httpd.

Exploit

Fix

LPE

Weakness Enumeration

CWE-1188

CWE-267

Related Identifiers

ALSA-2025:17428

ALSA-2025:17429

ALSA-2025:17509

BDU:2025-12421

BDU:2025-12432

CESA-2025_17509

CVE-2025-41244

DLA-4316-1

INFSA-2025_17428

INFSA-2025_17509

MGASA-2025-0237

RHSA-2025_17428

RHSA-2025_17509

SUSE-SU-2025:03535-1

SUSE-SU-2025:03585-1

USN-7785-1

Affected Products

Centos

Debian

Linuxmint

Red Hat

Ubuntu

Vmware Aria Operations

Vmware Tools

References · 143

• 🔥 https://blog.nviso.eu/2025/09/29/you-name-it-vmware-elevates-it-cve-2025-41244 · Exploit
• https://osv.dev/vulnerability/SUSE-SU-2025:03585-1 · Vendor Advisory
• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36149 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/725169 · Security Note
• https://ubuntu.com/security/CVE-2025-41244 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-41244 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-41244 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4316-1 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2025-17509.html · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2025:17429 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-41244 · Security Note
• https://linux.oracle.com/errata/ELSA-2025-17509.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-41244 · Security Note
• https://errata.almalinux.org/9/ALSA-2025-17428.html · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2025:17428 · Vendor Advisory