Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 544
Alerts This Week
Warning Icon 1 544

SUSE: 2022:2958-1 Critical: Open-VM-Tools Security Update

suse
Calendar Grey August 31, 2022
Scroller Suse
SUSE has issued a crucial security patch for open-vm-tools addressing a significant privilege escalation vulnerability found in the most recent version. For further information, see below.
An update that solves one vulnerability and has four fixes is now available

Summary

This update for open-vm-tools fixes the following issues: - CVE-2022-31676: Fixed an issue that could allow unprivileged users inside a virtual machine to escalate privileges (bsc#1202657). Non-security fixes: - Update to 11.0.5 (build 15389592) (bsc#1165955) DNS server is reported incorrectly in GuestInfo as '127.0.0.53', when the OS uses systemd-resolved. This issue is fixed in this release. Added Application Discover (appInfo) plugin. The plugin collects the information about running applications inside the guest and publishes the information to a guest variable. - GCC-10 compiler failure (bsc#1160408) The update will solve a GNU compiler Collection GCC10 failure with -fno-common. - Rectify a log spew in vmsvc logging (bsc#1162435, bsc#1162119) When a

Topics%20covered

Topics Covered

security advisory privilege escalation security fix important suse linux enterprise open-vm-tools

References

#1160408 #1162119 #1162435 #1165955 #1202657

Cross- CVE-2022-31676

CVSS scores:

CVE-2022-31676 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2022-31676 (SUSE): 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Products:

SUSE Linux Enterprise High Performance Computing 15-ESPOS

SUSE Linux Enterprise High Performance Computing 15-LTSS

SUSE Linux Enterprise Server for SAP 15

https://www.suse.com/security/cve/CVE-2022-31676.html

https://bugzilla.suse.com/1160408

https://bugzilla.suse.com/1162119

https://bugzilla.suse.com/1162435

https://bugzilla.suse.com/1165955

https://bugzilla.suse.com/1202657

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2022:2961-1
Rating: important

Topics%20covered

Topics Covered

security advisory privilege escalation security fix important suse linux enterprise open-vm-tools

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.