Security update for open-vm-tools SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:2961-1 Final 1 1 2022-08-31T13:47:19Z current 2022-08-31T13:47:19Z 2022-08-31T13:47:19Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for open-vm-tools This update for open-vm-tools fixes the following issues: - CVE-2022-31676: Fixed an issue that could allow unprivileged users inside a virtual machine to escalate privileges (bsc#1202657). Non-security fixes: - Update to 11.0.5 (build 15389592) (bsc#1165955) DNS server is reported incorrectly in GuestInfo as '127.0.0.53', when the OS uses systemd-resolved. This issue is fixed in this release. Added Application Discover (appInfo) plugin. The plugin collects the information about running applications inside the guest and publishes the information to a guest variable. - GCC-10 compiler failure (bsc#1160408) The update will solve a GNU compiler Collection GCC10 failure with -fno-common. - Rectify a log spew in vmsvc logging (bsc#1162435, bsc#1162119) When a LSI Logic Parallel SCSI controller sits in PCI bus 0 (SCSI controller 0), the Linux disk device enumeration does not provide a 'label' file with the controller name. This results in messages like 'GuestInfoGetDiskDevice: Missing disk device name; VMDK mapping unavailable for '/var/log', fsName: '/dev/sda2' repeatedly appearing in the vmsvc logging. The update converts what previously was a warning message to a debug message and thus avoids the log spew. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2022-2961,SUSE-SLE-Product-HPC-15-2022-2961,SUSE-SLE-Product-SLES_SAP-15-2022-2961 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20222961-1/ Link for SUSE-SU-2022:2961-1 https://lists.suse.com/pipermail/sle-security-updates/2022-August/012019.html E-Mail link for SUSE-SU-2022:2961-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1160408 SUSE Bug 1160408 https://bugzilla.suse.com/1162119 SUSE Bug 1162119 https://bugzilla.suse.com/1162435 SUSE Bug 1162435 https://bugzilla.suse.com/1165955 SUSE Bug 1165955 https://bugzilla.suse.com/1202657 SUSE Bug 1202657 https://www.suse.com/security/cve/CVE-2022-31676/ SUSE CVE CVE-2022-31676 page SUSE Linux Enterprise High Performance Computing 15-ESPOS SUSE Linux Enterprise High Performance Computing 15-LTSS SUSE Linux Enterprise Server for SAP Applications 15 libvmtools-devel-11.0.5-150000.3.29.1 libvmtools0-11.0.5-150000.3.29.1 open-vm-tools-11.0.5-150000.3.29.1 open-vm-tools-desktop-11.0.5-150000.3.29.1 libvmtools-devel-11.0.5-150000.3.29.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS libvmtools0-11.0.5-150000.3.29.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS open-vm-tools-11.0.5-150000.3.29.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS open-vm-tools-desktop-11.0.5-150000.3.29.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS libvmtools-devel-11.0.5-150000.3.29.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS libvmtools0-11.0.5-150000.3.29.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS open-vm-tools-11.0.5-150000.3.29.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS open-vm-tools-desktop-11.0.5-150000.3.29.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS libvmtools-devel-11.0.5-150000.3.29.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 libvmtools0-11.0.5-150000.3.29.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 open-vm-tools-11.0.5-150000.3.29.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 open-vm-tools-desktop-11.0.5-150000.3.29.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 VMware Tools (12.0.0, 11.x.y and 10.x.y) contains a local privilege escalation vulnerability. A malicious actor with local non-administrative access to the Guest OS can escalate privileges as a root user in the virtual machine. CVE-2022-31676 SUSE Linux Enterprise High Performance Computing 15-ESPOS:libvmtools-devel-11.0.5-150000.3.29.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:libvmtools0-11.0.5-150000.3.29.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:open-vm-tools-11.0.5-150000.3.29.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:open-vm-tools-desktop-11.0.5-150000.3.29.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:libvmtools-devel-11.0.5-150000.3.29.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:libvmtools0-11.0.5-150000.3.29.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:open-vm-tools-11.0.5-150000.3.29.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:open-vm-tools-desktop-11.0.5-150000.3.29.1 SUSE Linux Enterprise Server for SAP Applications 15:libvmtools-devel-11.0.5-150000.3.29.1 SUSE Linux Enterprise Server for SAP Applications 15:libvmtools0-11.0.5-150000.3.29.1 SUSE Linux Enterprise Server for SAP Applications 15:open-vm-tools-11.0.5-150000.3.29.1 SUSE Linux Enterprise Server for SAP Applications 15:open-vm-tools-desktop-11.0.5-150000.3.29.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222961-1/ https://www.suse.com/security/cve/CVE-2022-31676.html CVE-2022-31676 https://bugzilla.suse.com/1202657 SUSE Bug 1202657 https://bugzilla.suse.com/1202733 SUSE Bug 1202733 https://bugzilla.suse.com/1202834 SUSE Bug 1202834 https://bugzilla.suse.com/1202995 SUSE Bug 1202995 https://bugzilla.suse.com/1204044 SUSE Bug 1204044 https://bugzilla.suse.com/1205471 SUSE Bug 1205471