VMware Tools Local Privilege Escalation and SAML Token Signature Bypass Vulnerabilities - 20231031001¶
Overview¶
The WA SOC has observed multiple vulnerabilities released in VMWare tools.
VMware Tools contains a local privilege escalation vulnerability. A malicious actor with local user access to a guest virtual machine may elevate privileges within the virtual machine.
VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has been granted Guest Operation Privileges in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias
What is the vulnerability?¶
CVE-2023-34057 - CVSS v3 Base Score: 7.8
CVE-2023-34058 - CVSS v3 Base Score: 7.5
What is vulnerable?¶
The vulnerability affects the following VMWare tools versions:
- before 12.1.1 (running on macOS)
- before 12.3.5 (running on Windows)
What has been observed?¶
There is no evidence of exploitation affecting Western Australian Government networks at the time of publishing.
Recommendation¶
The WA SOC recommends administrators apply the solutions as per vendor instructions to all affected devices within expected timeframe of two weeks (refer Patch Management):