Target Industry
CVE-2025-41244 is a local privilege escalation vulnerability affecting VMware Aria Operations and VMware Tools. It allows a non-administrative user on a virtual machine (VM) to escalate privileges to root, posing serious risks in enterprise environments.
Overview
- Affected Products: VMware Aria Operations (versions prior to 8.18.5), VMware Tools (all versions of 11.x.x, versions of 12.x.x prior to 12.5.4, and versions of 13.x.x prior to 13.0.5), VMware Cloud Foundation Operations (versions prior to 9.0.1.0).
- Trigger Conditions: Exploitable when VMware Tools is installed on a VM managed by Aria Operations with SDMP (Software-Defined Management Platform) enabled.
- Severity: CVSSv3 base score of 7.8 (Important).
- Exploit Status: Actively exploited in the wild since October 2024.
Risks to Stakeholders
- Security Teams: Must act swiftly to patch systems to prevent root-level compromise.
- IT Operations: Should audit VM configurations for SDMP usage and ensure patch compliance.
- Compliance Officers: Need to assess exposure and document remediation for regulatory reporting.
- Executives: Should be aware of reputational and operational risks if exploited in production environments.
Mitigation
- Apply patches listed in Broadcom’s official advisory.
- For Linux systems, updated versions of open-vm-tools will be distributed by vendors.
- Monitor for unusual child processes as part of exploit detection.
Affected Products
Affected versions span the release branches of Cisco ASA and FTD 9.x and 6.x software versions.
- VMware Aria Operations
- Versions prior to 8.18.5 are vulnerable.
- VMware Tools
- All versions of 11.x.x
- Versions of 12.x.x prior to 12.5.4
- Versions of 13.x.x prior to 13.0.5.
- VMware Cloud Foundation
- Versions prior to 9.0.1.0.
- VMware Telco Cloud Platform
- VMware Telco Cloud Infrastructure
CVE-2025-41244: Technical Deep Dive
Root Cause
The vulnerability stems from unsafe privilege handling in the get-versions.sh script used by VMware Tools and Aria Operations’ SDMP (Service Discovery Management Pack). Specifically:
- The script uses a regular expression pattern (\S) to identify binaries for version checks.
- This pattern unintentionally includes user-writable directories like /tmp/httpd.
- When a privileged process (e.g., Aria Operations or vmtoolsd) scans for listening sockets, it may invoke malicious binaries staged in these paths.
This behaviour violates CWE-426: Untrusted Search Path, allowing attackers to hijack execution flow.
Exploitation Mechanics
Attacker Setup:
- A non-root user places a malicious binary in /tmp/httpd or similar writable path.
- The binary mimics a legitimate system utility and listens on a UNIX socket.
Trigger:
- Aria Operations or VMware Tools executes get-versions.sh, which scans for active sockets and invokes binaries using the -v flag.
Payload Execution:
- The malicious binary is executed with elevated privileges.
- It connects back to the attacker’s socket and spawns a root shell.
Contextual Risk
- In credential-less mode, open-vm-tools handles metrics collection under a privileged context, making exploitation automatic.
- In credential-based mode, Aria Operations runs the collector every 5 minutes using admin credentials, increasing exposure.
Detection & Mitigation
- Patch Immediately: Apply Broadcom’s fixes for VMware Tools and Aria Operations.
- Monitor:
- Watch for child processes of vmtoolsd or SDMP invoking binaries from /tmp or other non-standard paths.
- Filesystem Hardening:
- Restrict write access to directories matched by the vulnerable regex.
- Network Segmentation:
- Isolate guest VMs to reduce lateral movement risk.
This vulnerability is actively exploited by threat actors like UNC5174, making it a high-priority issue for hybrid-cloud environments.
Intelligence Terminology Yardstick
The threat report uses pre-defined language found within the Intelligence Terminology Yardstick to express the likelihood of events.
