Before diving into the details of CVE-2022-22964, it is essential to understand the role VMware Horizon Agent plays in the Linux ecosystem. VMware Horizon Agent is a software module that enables Linux remote desktop features and desktop virtualization capabilities of VMware Horizon. In simpler terms, it allows IT administrators to manage and secure Linux desktops remotely. Unfortunately, a recently discovered vulnerability affects versions of this software earlier than 22.x, leaving systems open to local privilege escalation attacks.

In this blog post, we'll delve into the specifics of CVE-2022-22964, explore how the vulnerability arises due to an insecure configuration file, and present potential exploit scenarios. Additionally, we'll provide links to the original references and offer recommendations to help secure your systems from this critical vulnerability.

The Vulnerability: CVE-2022-22964
As mentioned previously, the code vulnerability in VMware Horizon Agent for Linux concerns local privilege escalation. What does that mean? Local privilege escalation is a type of cyberattack where a threat actor with limited privileges gains elevated permissions—typically those of the root user—by exploiting a vulnerability present in the system.

In the case of CVE-2022-22964, a configuration file in VMware Horizon Agent for Linux (prior to version 22.x) is inadequately secured. Consequently, a malicious user can exploit this vulnerability to escalate their privileges to root, thereby increasing the risk of unauthorized system access, unauthorized data modification, and further attacks.

Analyzing the Code Snippet
The vulnerability stems from a misconfigured file known as vmware-horizon_vmware-vgauth_user.conf. The problematic section of the file features a broad regex expression, which allows for unintended privilege escalation:

command=USER_CMD1 /path/to/a/script arg1
regex=UserCommand *ScriptArg1

In this snippet, the command line defined allows any user to run unprivileged commands via the script assigned. However, the regex statement—UserCommand *ScriptArg1—grants permission to execute any arbitrary command line, followed by the keyword ScriptArg1.

Original Reference and Exploit Details
The vulnerability—CVE-2022-22964—was disclosed in the National Vulnerability Database, as well as VMware's official security advisories. You can read the official advisory here:

VMware Security Advisory VMSA-2022-0002

To illustrate the potential for exploitation, consider the following scenario. A malicious user with local access to an affected system could craft a custom command line that appears legitimate to VMware Horizon Agent but contains a payload, like the following example:

UserCommand /usr/bin/sudo payload_script_here ScriptArg1

By exploiting the insecure regex statement in vmware-horizon_vmware-vgauth_user.conf, an attacker can execute the payload script with elevated privileges, gaining root access to the entire system.

Protecting Your Systems
VMware has addressed CVE-2022-22964 by releasing an updated version (22.x and later) of the VMware Horizon Agent for Linux. It is critical to apply this security patch as soon as possible to ensure the protection of your systems. You can find download links and installation steps in the official VMware Security Advisory, which we shared earlier in this blog post.

In addition to patching your systems, it is advisable to follow best practices, such as minimizing the use of non-root accounts, routinely auditing system configurations, and monitoring logs to detect any suspicious activity.

Conclusion
The recently discovered CVE-2022-22964 vulnerability in VMware Horizon Agent for Linux is a crucial security concern for IT administrators managing Linux desktops remotely. By understanding the underlying cause of this local privilege escalation and applying the necessary security updates, you can help safeguard your systems and maintain a secure computing environment.

Remember to refer to the official VMware Security Advisory and the National Vulnerability Database for the latest updates on this vulnerability. As always, remain vigilant in protecting your digital infrastructure and stay informed about upcoming security threats.

Timeline

Published on: 04/11/2022 20:15:00 UTC
Last modified on: 07/30/2022 02:37:00 UTC