CVE-2023-34059: - File Descriptor Hijack vulnerability in open-vm-tools

Q: What is the severity of CVE-2023-34059?

CVE-2023-34059 has a medium severity rating due to its potential to allow non-root users to hijack file descriptors.

Q: How do I fix CVE-2023-34059?

To mitigate CVE-2023-34059, update open-vm-tools to the latest version available for your Linux distribution.

Q: Which versions of open-vm-tools are affected by CVE-2023-34059?

CVE-2023-34059 affects multiple versions of open-vm-tools below 2:12.3.0 and can vary across different Linux distributions.

Q: Who is the vendor of the software affected by CVE-2023-34059?

The vendor of the affected software in CVE-2023-34059 is VMware.

Q: What type of vulnerability is CVE-2023-34059?

CVE-2023-34059 is a file descriptor hijack vulnerability in the vmware-user-suid-wrapper.

Published Oct 25, 2023

Updated

open-vm-tools contains a file descriptor hijack vulnerability in the vmware-user-suid-wrapper. A malicious actor with non-root privileges may be able to hijack the /dev/uinput file descriptor allowing them to simulate user inputs.

Other sources

VMware Tools contains a file descriptor hijack vulnerability in the vmware-user-suid-wrapper. A malicious actor with non-root privileges may be able to hijack the /dev/uinput file descriptor allowing them to simulate user inputs.

— Red Hat

Affected Software

14 affected componentsFixes available

ubuntu/open-vm-tools<2:11.0.5-4ubuntu0.18.04.3+

2:11.0.5-4ubuntu0.18.04.3+

ubuntu/open-vm-tools<2:11.3.0-2ubuntu0~ubuntu20.04.7

2:11.3.0-2ubuntu0~ubuntu20.04.7

ubuntu/open-vm-tools<2:12.1.5-3~ubuntu0.22.04.4

2:12.1.5-3~ubuntu0.22.04.4

ubuntu/open-vm-tools<2:12.1.5-3ubuntu0.23.04.3

2:12.1.5-3ubuntu0.23.04.3

ubuntu/open-vm-tools<2:12.3.0-1ubuntu0.1

2:12.3.0-1ubuntu0.1

ubuntu/open-vm-tools<2:10.2.0-3~ubuntu0.16.04.1+

2:10.2.0-3~ubuntu0.16.04.1+

redhat/open-vm-tools<11.0.0

11.0.0

debian/open-vm-tools

2:11.2.5-2+deb11u32:12.2.0-1+deb12u22:12.4.5-1

VMware Open Vm Tools>=11.0.0<=12.3.0

Debian Debian Linux=10.0

Debian Debian Linux=11.0

Debian Debian Linux=12.0

IBM Security Verify Governance<=ISVG 10.0.2

IBM Security Verify Governance - Identity Manager virtual appliance component<=ISVG 10.0.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/open-vm-tools to a version that resolves this vulnerability.
Fixed in 2:11.0.5-4ubuntu0.18.04.3+
Upgrade
Upgrade ubuntu/open-vm-tools to a version that resolves this vulnerability.
Fixed in 2:11.3.0-2ubuntu0~ubuntu20.04.7
Upgrade
Upgrade ubuntu/open-vm-tools to a version that resolves this vulnerability.
Fixed in 2:12.1.5-3~ubuntu0.22.04.4
Upgrade
Upgrade ubuntu/open-vm-tools to a version that resolves this vulnerability.
Fixed in 2:12.1.5-3ubuntu0.23.04.3
Upgrade
Upgrade ubuntu/open-vm-tools to a version that resolves this vulnerability.
Fixed in 2:12.3.0-1ubuntu0.1
Upgrade
Upgrade ubuntu/open-vm-tools to a version that resolves this vulnerability.
Fixed in 2:10.2.0-3~ubuntu0.16.04.1+
Upgrade
Upgrade redhat/open-vm-tools to a version that resolves this vulnerability.
Fixed in 11.0.0
Upgrade
Upgrade debian/open-vm-tools to a version that resolves this vulnerability.
Fixed in 2:11.2.5-2+deb11u3Fixed in 2:12.2.0-1+deb12u2Fixed in 2:12.4.5-1

Event History

Oct 25, 2023

Data Sourced

via Red Hat·12:11 PM

DescriptionSeverityAffected Software

Oct 26, 2023

CVE Published

via Ubuntu·12:00 AM

Oct 27, 2023

CVE Published

via MITRE·04:53 AM

Data Sourced

via MITRE·04:53 AM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is the severity of CVE-2023-34059?