Vulnerability Description
VMware Tools (12.0.0, 11.x.y and 10.x.y) contains a local privilege escalation vulnerability. A malicious actor with local non-administrative access to the Guest OS can escalate privileges as a root user in the virtual machine.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Vmware | Tools | >= 10.0.0, < 12.1.0 |
| Microsoft | Windows | - |
| Linux | Linux Kernel | - |
| Debian | Debian Linux | 10.0 |
| Fedoraproject | Fedora | 36 |
| Netapp | Ontap Select Deploy Administration Utility | - |
Related Weaknesses (CWE)
References
- http://www.openwall.com/lists/oss-security/2022/08/23/3Mailing ListPatchRelease Notes
- https://lists.debian.org/debian-lts-announce/2022/08/msg00013.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.gentoo.org/glsa/202210-27Third Party Advisory
- https://security.netapp.com/advisory/ntap-20221017-0003/Third Party Advisory
- https://www.debian.org/security/2022/dsa-5215Third Party Advisory
- https://www.vmware.com/security/advisories/VMSA-2022-0024.htmlRelease NotesVendor Advisory
- http://www.openwall.com/lists/oss-security/2022/08/23/3Mailing ListPatchRelease Notes
- https://lists.debian.org/debian-lts-announce/2022/08/msg00013.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.gentoo.org/glsa/202210-27Third Party Advisory
FAQ
What is CVE-2022-31676?
CVE-2022-31676 is a vulnerability with a CVSS score of 7.8 (HIGH). VMware Tools (12.0.0, 11.x.y and 10.x.y) contains a local privilege escalation vulnerability. A malicious actor with local non-administrative access to the Guest OS can escalate privileges as a root u...
How severe is CVE-2022-31676?
CVE-2022-31676 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-31676?
Check the references section above for vendor advisories and patch information. Affected products include: Vmware Tools, Microsoft Windows, Linux Linux Kernel, Debian Debian Linux, Fedoraproject Fedora.