Listen to this Post
The CVE-2024-22267 vulnerability is a local privilege escalation flaw within the interaction of VMware Aria Operations and VMware Tools. The specific mechanism involves the Service Discovery Management Protocol (SDMP) in Aria Operations. When Aria Operations is configured to manage a virtual machine and SDMP is enabled, it communicates with the VMware Tools service installed on that guest VM. A malicious actor, already possessing local non-administrative user access on the guest VM, can exploit improper permission handling or a race condition within this communication channel. By sending specially crafted requests or intercepting the SDMP communication, the attacker can manipulate the VMware Tools service. This manipulation causes the service, which runs with elevated SYSTEM or root privileges, to execute arbitrary operating system commands on behalf of the attacker. This successfully grants the low-privileged user full root or SYSTEM level access on the compromised virtual machine.
Platform: VMware Aria Operations
Version: (See affected versions)
Vulnerability: Local Privilege Escalation
Severity: High
date: 2024-06-11
Prediction: 2024-07-23
What Undercode Say:
ps aux | grep vmtoolsd cat /etc/vmware-tools/tools.conf | grep -i sdmp whoami id
PoC concept: Intercept SDMP communication import socket target_ip = "127.0.0.1" ... code to craft malicious SDMP payload
How Exploit:
Attacker with local shell access exploits flawed SDMP handling in VMware Tools service to execute commands as root.
Protection from this CVE
Apply vendor patches. Disable SDMP in Aria Operations if not required. Restrict local user access to sensitive VMs.
Impact:
Full system compromise of the guest virtual machine. Bypasses all local security controls.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: www.cve.org
Extra Source Hub:
Undercode
