^{CVE-2023-34058:}VMware Tools SAML token signature bypass vulnerability allows privilege escalation in virtual machines.

Overview

This vulnerability (CVE-2023-34058) affects VMware Tools and involves a SAML token signature bypass vulnerability. The issue occurs when a malicious actor who already has Guest Operation Privileges in a target virtual machine attempts to exploit the vulnerability. If the target virtual machine has been assigned a more privileged Guest Alias, the attacker may be able to bypass signature verification mechanisms and elevate their privileges beyond what was initially granted. This is classified as CWE-347 (Improper Verification of Cryptographic Signature), which indicates that the application does not properly verify that a cryptographic signature is valid.

Remediation

To mitigate this vulnerability, system administrators should:

1. Update VMware Tools to the latest version as recommended in the VMware security advisory VMSA-2023-0024.
2. Review and restrict Guest Operation Privileges to only necessary users.
3. Audit the assignment of Guest Aliases to ensure they follow the principle of least privilege.
4. Monitor virtual machine activities for suspicious privilege escalation attempts.
5. Apply patches provided by your operating system vendor (Debian, Fedora, etc.) if using their packaged versions of VMware Tools.

References

1. VMware Security Advisory: https://www.vmware.com/security/advisories/VMSA-2023-0024.html
2. Debian Security Advisory: https://www.debian.org/security/2023/dsa-5543
3. Debian LTS Announcement: https://lists.debian.org/debian-lts-announce/2023/11/msg00002.html
4. Fedora Package Announcements:
   • https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G7G77Z76CQPGUF7VHRA6O3UFCMPPR4O2/
   • https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQUOFQL2SNNNMKROQ3TZQY4HEYMNOIBW/
   • https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLTKVTRKQW2GD2274H3UOW6XU4E62GSK/
5. OSS Security Mailing List: http://www.openwall.com/lists/oss-security/2023/10/27/1
6. VMware Documentation on Guest Operation Privileges: https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html
7. VMware Documentation on Guest Alias: https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html