Skip to content
OpenAdvisories
High 1 exploited CVE ALAS2-2025-3036 1 CVE

Important: open-vm-tools security update (Amazon Linux 2)

Published Oct 14, 2025 · Updated Oct 14, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-41244: VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.

Fixed packages 7

ReleasePackageFixed in
Amazon Linux · 2 open-vm-tools 0:12.3.0-1.amzn2.0.4
Amazon Linux · 2 open-vm-tools-debuginfo 0:12.3.0-1.amzn2.0.4
Amazon Linux · 2 open-vm-tools-desktop 0:12.3.0-1.amzn2.0.4
Amazon Linux · 2 open-vm-tools-devel 0:12.3.0-1.amzn2.0.4
Amazon Linux · 2 open-vm-tools-salt-minion 0:12.3.0-1.amzn2.0.4
Amazon Linux · 2 open-vm-tools-sdmp 0:12.3.0-1.amzn2.0.4
Amazon Linux · 2 open-vm-tools-test 0:12.3.0-1.amzn2.0.4

Vulnerabilities 1

  • High 7.8
    CVE-2025-41244 Exploited Public exploit EPSS 16%

    VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246)

    VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may explo…

    VMware VMware Aria Operations VMware Telco Cloud Platform VMware Cloud Foundation Debian Ubuntu Azure Linux
    KEV Oct 30, 2025

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-41244.html