CVE-2022-31676

Description

VMware Tools (12.0.0, 11.x.y and 10.x.y) contains a local privilege escalation vulnerability. A malicious actor with local non-administrative access to the Guest OS can escalate privileges as a root user in the virtual machine.

Affected products

Vendor	Product	Affected	Fixed
—	VMware Tools	VMware Tools (12.0.0, 11.x.y and 10.x.y)	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	open-vm-tools	2:12.1.0-1	—
Debian 13	open-vm-tools	2:12.1.0-1	—
Debian 12	open-vm-tools	2:12.1.0-1	—
Debian 11	open-vm-tools	2:11.2.5-2+deb11u1	DSA-5215-1
Debian 10	open-vm-tools	2:10.3.10-1+deb10u3	DLA-3081-1

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 22.04 LTS	open-vm-tools	2:11.3.5-1ubuntu4.1	USN-5578-1
Ubuntu 20.04 LTS	open-vm-tools	2:11.3.0-2ubuntu0~ubuntu20.04.3	USN-5578-1
Ubuntu 18.04 LTS	open-vm-tools	2:11.0.5-4ubuntu0.18.04.2	USN-5578-1

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 16.04 LTS	open-vm-tools	2:10.2.0-3~ubuntu0.16.04.1+esm1	USN-5578-2

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 9	open-vm-tools +3	11.3.5-1.el9_0.1	RHSA-2022:6358
RHEL 8	open-vm-tools +2	11.3.5-1.el8_6.1	RHSA-2022:6357
RHEL 7	open-vm-tools +3	11.0.5-3.el7_9.4	RHSA-2022:6381

Show 3 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
RHEL 8.4 EUS	open-vm-tools +2	11.2.0-2.el8_4.1	RHSA-2022:6356
RHEL 8.2 EUS	open-vm-tools +1	11.0.0-4.el8_2.1	RHSA-2022:6355
RHEL 8.1 E4S	open-vm-tools +1	10.3.10-3.el8_1.3	RHSA-2022:6354

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 9	open-vm-tools +3	11.3.5-1.el9_0.1	ALSA-2022:6358
AlmaLinux 8	open-vm-tools +2	11.3.5-1.el8_6.1	ALSA-2022:6357

Rocky Linux

Errata ↗

Release	Package	Fixed in	Advisory
Rocky Linux 9	open-vm-tools	11.3.5-1.el9_0.1	RLSA-2022:6358
Rocky Linux 8	open-vm-tools	11.3.5-1.el8_6.1	RLSA-2022:6357

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP4	open-vm-tools	12.1.0-150300.19.1	SUSE-SU-2022:2936-1
SLES 15 SP3	open-vm-tools	12.1.0-150300.19.1	SUSE-SU-2022:2936-1
SLES 15 SP2	open-vm-tools	11.3.5-150200.5.16.11.1	SUSE-SU-2022:2985-1
SLES 15 SP1	open-vm-tools	11.3.5-150100.4.37.13.1	SUSE-SU-2022:2986-1
SLES 12 SP5	open-vm-tools	12.1.0-4.45.1	SUSE-SU-2022:2935-1

Show 20 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES 12 SP4	open-vm-tools	12.1.0-4.45.1	SUSE-SU-2022:2935-1
SLES 12 SP3	open-vm-tools	10.3.10-3.34.1	SUSE-SU-2022:2962-1
SLES 12 SP2	open-vm-tools	10.2.0-9.9.1	SUSE-SU-2022:2940-1
SLES for SAP 15 SP2	open-vm-tools	11.3.5-150200.5.16.11.1	SUSE-SU-2022:2985-1
SLES for SAP 15 SP1	open-vm-tools	11.3.5-150100.4.37.13.1	SUSE-SU-2022:2986-1
SLES for SAP 15	open-vm-tools	11.0.5-150000.3.29.1	SUSE-SU-2022:2961-1
SLES for SAP 12 SP5	open-vm-tools	12.1.0-4.45.1	SUSE-SU-2022:2935-1
SLES for SAP 12 SP4	open-vm-tools	12.1.0-4.45.1	SUSE-SU-2022:2935-1
SLE Micro 5.2	open-vm-tools	12.1.0-150300.19.1	SUSE-SU-2022:2936-1
SLE Micro 5.1	open-vm-tools	12.1.0-150300.19.1	SUSE-SU-2022:2936-1
SLE HPC 15 SP2	open-vm-tools	11.3.5-150200.5.16.11.1	SUSE-SU-2022:2985-1
SLE HPC 15 SP1	open-vm-tools	11.3.5-150100.4.37.13.1	SUSE-SU-2022:2986-1
SLE HPC 15	open-vm-tools	11.0.5-150000.3.29.1	SUSE-SU-2022:2961-1
SUSE OpenStack Cloud Crowbar 9	open-vm-tools	12.1.0-4.45.1	SUSE-SU-2022:2935-1
SUSE OpenStack Cloud 9	open-vm-tools	12.1.0-4.45.1	SUSE-SU-2022:2935-1
SUSE Manager Server 4.1	open-vm-tools	11.3.5-150200.5.16.11.1	SUSE-SU-2022:2985-1
SUSE Manager Retail Branch Server 4.1	open-vm-tools	11.3.5-150200.5.16.11.1	SUSE-SU-2022:2985-1
SUSE Manager Proxy 4.1	open-vm-tools	11.3.5-150200.5.16.11.1	SUSE-SU-2022:2985-1
SUSE Enterprise Storage 7	open-vm-tools	11.3.5-150200.5.16.11.1	SUSE-SU-2022:2985-1
SUSE Enterprise Storage 6	open-vm-tools	11.3.5-150100.4.37.13.1	SUSE-SU-2022:2986-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	open-vm-tools	12.1.0-1.1	openSUSE-SU-2024:12288-1
openSUSE Leap 15.4	open-vm-tools	12.1.0-150300.19.1	SUSE-SU-2022:2936-1
openSUSE Leap 15.3	open-vm-tools	12.1.0-150300.19.1	SUSE-SU-2022:2936-1

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
openSUSE Leap Micro 5.2	open-vm-tools	12.1.0-150300.19.1	SUSE-SU-2022:2936-2

Alpine

Security tracker ↗

Release	Package	Fixed in	Advisory
Alpine v3.24	open-vm-tools	12.1.0-r0	—
Alpine v3.23	open-vm-tools	12.1.0-r0	—
Alpine v3.22	open-vm-tools	12.1.0-r0	—
Alpine v3.21	open-vm-tools	12.1.0-r0	—
Alpine v3.20	open-vm-tools	12.1.0-r0	—

Show 6 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Alpine v3.19	open-vm-tools	12.1.0-r0	—
Alpine v3.18	open-vm-tools	12.1.0-r0	—
Alpine v3.17	open-vm-tools	12.1.0-r0	—
Alpine v3.16	open-vm-tools	12.1.0-r0	—
Alpine v3.15	open-vm-tools	11.3.5-r2	—
Alpine v3.14	open-vm-tools	11.2.5-r1	—

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2	open-vm-tools +5	12.1.0-4.amzn2.0.2	ALAS2-2023-2114

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 9	open-vm-tools +3	11.3.5-1.0.1.el9_0.1	ELSA-2022-6358
Oracle Linux 8	open-vm-tools +2	11.3.5-1.0.1.el8_6.1	ELSA-2022-6357
Oracle Linux 7	open-vm-tools +3	11.0.5-3.0.1.el7_9.4	ELSA-2022-6381

Advisories 30

ALSA-2022:6358 Important: open-vm-tools security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2022:6357 Important: open-vm-tools security update AlmaLinux Security Advisories · Oct 29, 2026
RHSA-2022:6381 Red Hat Security Advisory: open-vm-tools security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
USN-5578-2 open-vm-tools vulnerability Ubuntu Security Notices (USN) · Jun 25, 2026
USN-5578-1 open-vm-tools vulnerability Ubuntu Security Notices (USN) · Apr 22, 2026
DSA-5215-1 open-vm-tools - security update Debian Security (DSA / DLA) · Mar 9, 2026
DLA-3081-1 open-vm-tools - security update Debian Security (DSA / DLA) · Mar 9, 2026
RLSA-2022:6358 Important: open-vm-tools security update Rocky Linux Security Advisories · Feb 5, 2026
RLSA-2022:6357 Important: open-vm-tools security update Rocky Linux Security Advisories · Feb 4, 2026
SUSE-SU-2022:2940-1 Security update for open-vm-tools SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2022:2935-1 Security update for open-vm-tools SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2022:2986-1 Security update for open-vm-tools SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2022:2936-1 Security update for open-vm-tools SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2024:12288-1 libvmtools-devel-12.1.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2022:2962-1 Security update for open-vm-tools SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2022:2936-2 Security update for open-vm-tools SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2022:2985-1 Security update for open-vm-tools SUSE / openSUSE Security Updates · Feb 4, 2026
RHSA-2022:6358 Red Hat Security Advisory: open-vm-tools security update Red Hat Security Advisories (RHSA) · Dec 27, 2025
RHSA-2022:6357 Red Hat Security Advisory: open-vm-tools security update Red Hat Security Advisories (RHSA) · Dec 27, 2025
RHSA-2022:6356 Red Hat Security Advisory: open-vm-tools security update Red Hat Security Advisories (RHSA) · Dec 27, 2025
RHSA-2022:6354 Red Hat Security Advisory: open-vm-tools security update Red Hat Security Advisories (RHSA) · Dec 27, 2025
RHSA-2022:6355 Red Hat Security Advisory: open-vm-tools security update Red Hat Security Advisories (RHSA) · Dec 27, 2025
WID-SEC-2022-1159 VMware Tools: Schwachstelle ermöglicht Privilegieneskalation BSI CERT-Bund (WID) · Jul 31, 2025
ICSA-24-102-04 Siemens RUGGEDCOM APE1808 CISA ICS & IT advisories · May 13, 2025
SSA-455250 SSA-455250: Multiple Vulnerabilities in Palo Alto Networks Virtual NGFW on RUGGEDCOM APE1808 Devices Before V11.1.2-h3 Siemens ProductCERT · May 13, 2025
SUSE-SU-2022:2961-1 Security update for open-vm-tools SUSE / openSUSE Security Updates · May 2, 2025
ALAS2-2023-2114 Important: open-vm-tools security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jul 19, 2023
ELSA-2022-6358 Important: open-vm-tools security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Sep 7, 2022
ELSA-2022-6381 Important: open-vm-tools security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Sep 7, 2022
ELSA-2022-6357 Important: open-vm-tools security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Sep 6, 2022

References

https://www.vmware.com/security/advisories/VMSA-2022-0024.html
[oss-security] 20220823 [SECURITY ADVISORY] open-vm-tools: Local privilege escalation vulnerability (CVE-2022-31676) mailing-list
DSA-5215 vendor-advisory
[debian-lts-announce] 20220825 [SECURITY] [DLA 3081-1] open-vm-tools security update mailing-list
FEDORA-2022-cd23eac6f4 vendor-advisory
FEDORA-2022-1b8d3b2845 vendor-advisory
FEDORA-2022-1c9c0bacaf vendor-advisory
https://security.netapp.com/advisory/ntap-20221017-0003/
GLSA-202210-27 vendor-advisory

VMware Tools (12.0.0, 11.x.y and 10.x.y) contains a local privilege escalation vulnerability. A malicious actor with local non-administrati…

Description

Affected products

Fixed in Linux distributions

Debian

Ubuntu

Red Hat

AlmaLinux

Rocky Linux

SUSE

openSUSE

Alpine

Amazon Linux

Oracle Linux

Advisories 30

References