CVE-2025-41244

VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.

The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of guest operating system virtualization components that enhance performance and user experience of virtual machines.

Security Fix(es):

• open-vm-tools: Local privilege escalation in open-vm-tools (CVE-2025-41244)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of guest operating system virtualization components that enhance performance and user experience of virtual machines.

Security Fix(es):

• open-vm-tools: Local privilege escalation in open-vm-tools (CVE-2025-41244)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of guest operating system virtualization components that enhance performance and user experience of virtual machines.

Security Fix(es):

• open-vm-tools: Local privilege escalation in open-vm-tools (CVE-2025-41244)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.

The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of guest operating system virtualization components that enhance performance and user experience of virtual machines.

Security Fix(es):

• open-vm-tools: Local privilege escalation in open-vm-tools (CVE-2025-41244)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of guest operating system virtualization components that enhance performance and user experience of virtual machines.

Security Fix(es):

• open-vm-tools: Local privilege escalation in open-vm-tools (CVE-2025-41244)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of guest operating system virtualization components that enhance performance and user experience of virtual machines.

Security Fix(es):

• open-vm-tools: Local privilege escalation in open-vm-tools (CVE-2025-41244)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.

• CVE-2025-41244: fix local privilege escalation in the SDMP plugin by disabling execution of the get-versions.sh script (disabled by default)

It was discovered that open-vm-tools contains a local privilege escalation vulnerability. A malicious actor with non-administrative privileges on a guest VM may exploit this vulnerability to escalate privileges to root on the same VM (CVE-2025-41244).

These are all security issues fixed in the libvmtools-devel-13.0.5-1.1 package on the GA media of openSUSE Tumbleweed.

This update for open-vm-tools fixes the following issues:

Update to open-vm-tools 13.0.5 based on build 24915695. (boo#1250692):

Please refer to the Release Notes at https://github.com/vmware/open-vm-tools/blob/stable-13.0.5/ReleaseNotes.md.

The granular changes that have gone into the open-vm-tools 13.0.5 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-13.0.5/open-vm-tools/ChangeLog.

There are no new features in the open-vm-tools 13.0.5 release. This is primarily a maintenance release that addresses a security issue.

This release resolves and includes the patch for CVE-2025-41244. For more information on this vulnerability and its impact on Broadcom products, see VMSA-2025-0015.

A minor enhancement has been made for Guest OS Customization. The DeployPkg plugin has been updated to use "systemctl reboot", if available.

For a more complete list of issues addressed in this release, see the What's New and Resolved Issues section of the Release Notes.

This update for open-vm-tools fixes the following issues:

• update to 13.0.10 based on build 25056151 (boo#1257357):
  • There are no new features in the open-vm-tools 13.0.10 release.
  • This is primarily a maintenance release that addresses a fix.
  • A minor enhancement has been made for Guest OS Customization.
  • The DeployPkg plugin has been updated to handle a new cloud-init error code that signals a recoverable error and allow cloud-init to finish running.

This update for open-vm-tools fixes the following issues:

• CVE-2025-41244: local privilege escalation via the Service Discovery Plugin (bsc#1250373).

This update for open-vm-tools fixes the following issues:

• CVE-2025-41244: local privilege escalation via the Service Discovery Plugin (bsc#1250373).

This update for open-vm-tools fixes the following issues:

• CVE-2025-41244: local privilege escalation via the Service Discovery Plugin (bsc#1250373).

This update for open-vm-tools fixes the following issues:

• CVE-2025-41244: fixed a local privilege escalation vulnerability (bnc#1250373).

This update for open-vm-tools fixes the following issues:

• CVE-2025-41244: fixed a local privilege escalation vulnerability (bnc#1250373).

This update for open-vm-tools fixes the following issues:

Update to open-vm-tools 13.0.5 based on build 24915695. (bsc#1250692):

Please refer to the Release Notes at https://github.com/vmware/open-vm-tools/blob/stable-13.0.5/ReleaseNotes.md.

The granular changes that have gone into the open-vm-tools 13.0.5 release are in the ChangeLog at

https://github.com/vmware/open-vm-tools/blob/stable-13.0.5/open-vm-tools/ChangeLog.

There are no new features in the open-vm-tools 13.0.5 release. This is primarily a maintenance release that addresses a security issue.

This release resolves and includes the patch for CVE-2025-41244. For more information on this vulnerability and its impact on Broadcom products, see VMSA-2025-0015.

A minor enhancement has been made for Guest OS Customization. The DeployPkg plugin has been updated to use "systemctl reboot", if available.

For a more complete list of issues addressed in this release, see the What's New and Resolved Issues section of the Release Notes.

This update for open-vm-tools fixes the following issues:

Update to open-vm-tools 13.0.5 based on build 24915695. (bsc#1250692):

Please refer to the Release Notes at:

https://github.com/vmware/open-vm-tools/blob/stable-13.0.5/ReleaseNotes.md.

The granular changes that have gone into the open-vm-tools 13.0.5 release are in the ChangeLog at:

https://github.com/vmware/open-vm-tools/blob/stable-13.0.5/open-vm-tools/ChangeLog.

There are no new features in the open-vm-tools 13.0.5 release. This is primarily a maintenance release that addresses a security issue.

This release resolves and includes the patch for CVE-2025-41244. For more information on this vulnerability and its impact on Broadcom products, see VMSA-2025-0015.

A minor enhancement has been made for Guest OS Customization. The DeployPkg plugin has been updated to use "systemctl reboot", if available.

For a more complete list of issues addressed in this release, see the What's New and Resolved Issues section of the Release Notes.

This update for open-vm-tools fixes the following issues:

Update to open-vm-tools 13.0.5 based on build 24915695. (boo#1250692):

Please refer to the Release Notes at https://github.com/vmware/open-vm-tools/blob/stable-13.0.5/ReleaseNotes.md.

The granular changes that have gone into the open-vm-tools 13.0.5 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-13.0.5/open-vm-tools/ChangeLog.

There are no new features in the open-vm-tools 13.0.5 release. This is primarily a maintenance release that addresses a security issue.

This release resolves and includes the patch for CVE-2025-41244. For more information on this vulnerability and its impact on Broadcom products, see VMSA-2025-0015.

A minor enhancement has been made for Guest OS Customization. The DeployPkg plugin has been updated to use "systemctl reboot", if available.

For a more complete list of issues addressed in this release, see the What's New and Resolved Issues section of the Release Notes.

This update for open-vm-tools fixes the following issues:

Update to open-vm-tools 13.0.5 based on build 24915695. (boo#1250692):

Please refer to the Release Notes at https://github.com/vmware/open-vm-tools/blob/stable-13.0.5/ReleaseNotes.md.

The granular changes that have gone into the open-vm-tools 13.0.5 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-13.0.5/open-vm-tools/ChangeLog.

There are no new features in the open-vm-tools 13.0.5 release. This is primarily a maintenance release that addresses a security issue.

This release resolves and includes the patch for CVE-2025-41244. For more information on this vulnerability and its impact on Broadcom products, see VMSA-2025-0015.

A minor enhancement has been made for Guest OS Customization. The DeployPkg plugin has been updated to use "systemctl reboot", if available.

For a more complete list of issues addressed in this release, see the What's New and Resolved Issues section of the Release Notes.

It was discovered that Open VM Tools incorrectly handled permissions with version checking. An attacker could possibly use this issue to escalate privileges inside a virtual machine.

This update disables the SDMP get-versions.sh script, so version information may no longer be made available.