CVE-2023-34059 json
open-vm-tools contains a file descriptor hijack vulnerability in the vmware-user-suid-wrapper.
published 2023-10-27 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-38173
- cvss
- 7.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 34%
- public exploits
- 0
- none known
Summary
open-vm-tools contains a file descriptor hijack vulnerability in the vmware-user-suid-wrapper. A malicious actor with non-root privileges may be able to hijack the /dev/uinput file descriptor allowing them to simulate user inputs.
Patch / fix
- open-vm-tools Debian 12 2:12.2.0-1+deb12u2
- open-vm-tools Debian 14, Debian 13 2:12.3.5-1
debian advisories DEBIAN-CVE-2023-34059
- open-vm-tools Ubuntu 20.04 LTS 2:11.3.0-2ubuntu0~ubuntu20.04.7
- open-vm-tools Ubuntu 22.04 LTS 2:12.1.5-3~ubuntu0.22.04.4
- open-vm-tools Ubuntu Pro 14.04 LTS 2:9.4.0-1280544-5ubuntu6.4+esm1
- open-vm-tools Ubuntu Pro 16.04 LTS 2:10.2.0-3~ubuntu0.16.04.1+esm4
- open-vm-tools Ubuntu Pro 18.04 LTS 2:11.0.5-4ubuntu0.18.04.3+esm3
ubuntu advisories UBUNTU-CVE-2023-34059
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- open-vm-tools RHEL 7 11.0.5-3.el7_9.9
- open-vm-tools-test RHEL 7 11.0.5-3.el7_9.9
- open-vm-tools-desktop RHEL 7 11.0.5-3.el7_9.9
- open-vm-tools RHEL 9 12.2.5-3.el9_3.2
- open-vm-tools-sdmp RHEL 9 12.2.5-3.el9_3.2
- open-vm-tools-test RHEL 9 12.2.5-3.el9_3.2
- open-vm-tools-desktop RHEL 9 12.2.5-3.el9_3.2
- open-vm-tools-salt-minion RHEL 9 12.2.5-3.el9_3.2
red hat advisories RHSA-2023:7267RHSA-2023:7279RHSA-2023:7261RHSA-2023:7277RHSA-2023:7262RHSA-2023:7260
- open-vm-tools SLES for SAP 12 SP5, SLES 12 SP5 12.3.0-4.62.1
- open-vm-tools SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Module for Desktop Applications 15 SP5 +17 more 12.3.0-150300.43.1
- open-vm-tools SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLE High Performance Computing 15 SP1-LTSS 11.3.5-150100.4.37.21.1
- open-vm-tools SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLE High Performance Computing 15 SP2-LTSS 11.3.5-150200.5.16.19.1
suse advisories SUSE-SU-2023:4230-1SUSE-SU-2023:4229-1SUSE-SU-2023:4228-1SUSE-SU-2023:4227-1
- open-vm-tools openSUSE Tumbleweed 12.3.0-5.1
opensuse advisories openSUSE-SU-2024:13374-1
- open-vm-tools AlmaLinux 8 12.2.5-3.el8_9.1.alma.1
- open-vm-tools-sdmp AlmaLinux 8 12.2.5-3.el8_9.1.alma.1
- open-vm-tools-desktop AlmaLinux 8 12.2.5-3.el8_9.1.alma.1
- open-vm-tools-salt-minion AlmaLinux 8 12.2.5-3.el8_9.1.alma.1
- open-vm-tools AlmaLinux 9 12.2.5-3.el9_3.2.alma.1
- open-vm-tools-sdmp AlmaLinux 9 12.2.5-3.el9_3.2.alma.1
- open-vm-tools-test AlmaLinux 9 12.2.5-3.el9_3.2.alma.1
- open-vm-tools-desktop AlmaLinux 9 12.2.5-3.el9_3.2.alma.1
almalinux advisories ALSA-2023:7265ALSA-2023:7277
- open-vm-tools Rocky Linux 8 12.2.5-3.el8_9.1
rocky linux advisories RLSA-2023:7265
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2023-34059 updated cvss 7.4
open-vm-tools: file descriptor hijack vulnerability in the vmware-user-suid-wrapper
-
Red Hat Enterprise Linux AppStream (v. 8) open-vm-tools 12.2.5-3.el8_9.1, open-vm-tools-sdmp 12.2.5-3.el8_9.1, open-vm-tools-desktop 12.2.5-3.el8_9.1, open-vm-tools-salt-minion 12.2.5-3.el8_9.1fixed: vendor fix RHSA-2023:7265
-
Red Hat Enterprise Linux AppStream (v. 9) open-vm-tools 12.2.5-3.el9_3.2, open-vm-tools-sdmp 12.2.5-3.el9_3.2, open-vm-tools-test 12.2.5-3.el9_3.2, open-vm-tools-desktop 12.2.5-3.el9_3.2, open-vm-tools-salt-minion 12.2.5-3.el9_3.2fixed: vendor fix RHSA-2023:7277
-
Red Hat Enterprise Linux AppStream AUS (v. 8.2) open-vm-tools 11.0.0-4.el8_2.4, open-vm-tools-desktop 11.0.0-4.el8_2.4fixed: vendor fix RHSA-2023:7261
-
Red Hat Enterprise Linux AppStream AUS (v.8.4) open-vm-tools 11.2.0-2.el8_4.4, open-vm-tools-sdmp 11.2.0-2.el8_4.4, open-vm-tools-desktop 11.2.0-2.el8_4.4fixed: vendor fix RHSA-2023:7262
-
Red Hat Enterprise Linux AppStream E4S (v. 8.1) open-vm-tools 10.3.10-3.el8_1.5, open-vm-tools-desktop 10.3.10-3.el8_1.5fixed: vendor fix RHSA-2023:7260
-
Red Hat Enterprise Linux AppStream E4S (v. 8.2) open-vm-tools 11.0.0-4.el8_2.4, open-vm-tools-desktop 11.0.0-4.el8_2.4fixed: vendor fix RHSA-2023:7261
-
Red Hat Enterprise Linux AppStream E4S (v.8.4) open-vm-tools 11.2.0-2.el8_4.4, open-vm-tools-sdmp 11.2.0-2.el8_4.4, open-vm-tools-desktop 11.2.0-2.el8_4.4fixed: vendor fix RHSA-2023:7262
-
Red Hat Enterprise Linux AppStream EUS (v.8.6) open-vm-tools 11.3.5-1.el8_6.5, open-vm-tools-sdmp 11.3.5-1.el8_6.5, open-vm-tools-desktop 11.3.5-1.el8_6.5fixed: vendor fix RHSA-2023:7263
show 6 moreshow fewer
-
Red Hat Enterprise Linux AppStream EUS (v.8.8) open-vm-tools 12.1.5-2.el8_8.4, open-vm-tools-sdmp 12.1.5-2.el8_8.4, open-vm-tools-desktop 12.1.5-2.el8_8.4, open-vm-tools-salt-minion 12.1.5-2.el8_8.4fixed: vendor fix RHSA-2023:7264
-
Red Hat Enterprise Linux AppStream EUS (v.9.0) open-vm-tools 11.3.5-1.el9_0.5, open-vm-tools-sdmp 11.3.5-1.el9_0.5, open-vm-tools-test 11.3.5-1.el9_0.5, open-vm-tools-desktop 11.3.5-1.el9_0.5fixed: vendor fix RHSA-2023:7267
-
Red Hat Enterprise Linux AppStream EUS (v.9.2) open-vm-tools 12.1.5-1.el9_2.4, open-vm-tools-sdmp 12.1.5-1.el9_2.4, open-vm-tools-test 12.1.5-1.el9_2.4, open-vm-tools-desktop 12.1.5-1.el9_2.4, open-vm-tools-salt-minion 12.1.5-1.el9_2.4fixed: vendor fix RHSA-2023:7276
-
Red Hat Enterprise Linux AppStream TUS (v. 8.2) open-vm-tools 11.0.0-4.el8_2.4, open-vm-tools-desktop 11.0.0-4.el8_2.4fixed: vendor fix RHSA-2023:7261
-
Red Hat Enterprise Linux AppStream TUS (v.8.4) open-vm-tools 11.2.0-2.el8_4.4, open-vm-tools-sdmp 11.2.0-2.el8_4.4, open-vm-tools-desktop 11.2.0-2.el8_4.4fixed: vendor fix RHSA-2023:7262
-
Red Hat Enterprise Linux Client (v. 7) open-vm-tools 11.0.5-3.el7_9.9, open-vm-tools-test 11.0.5-3.el7_9.9, open-vm-tools-desktop 11.0.5-3.el7_9.9 Red Hat Enterprise Linux Client Optional (v. 7) open-vm-tools 11.0.5-3.el7_9.9, open-vm-tools-test 11.0.5-3.el7_9.9, open-vm-tools-desktop 11.0.5-3.el7_9.9 Red Hat Enterprise Linux ComputeNode Optional (v. 7) open-vm-tools 11.0.5-3.el7_9.9, open-vm-tools-test 11.0.5-3.el7_9.9, open-vm-tools-desktop 11.0.5-3.el7_9.9 Red Hat Enterprise Linux Server (v. 7) open-vm-tools 11.0.5-3.el7_9.9, open-vm-tools-test 11.0.5-3.el7_9.9, open-vm-tools-desktop 11.0.5-3.el7_9.9 Red Hat Enterprise Linux Server Optional (v. 7) open-vm-tools 11.0.5-3.el7_9.9, open-vm-tools-test 11.0.5-3.el7_9.9, open-vm-tools-desktop 11.0.5-3.el7_9.9 Red Hat Enterprise Linux Workstation (v. 7) open-vm-tools 11.0.5-3.el7_9.9, open-vm-tools-test 11.0.5-3.el7_9.9, open-vm-tools-desktop 11.0.5-3.el7_9.9fixed: vendor fix RHSA-2023:7279
+1 more productsfewer
Red Hat Enterprise Linux Workstation Optional (v. 7) open-vm-tools 11.0.5-3.el7_9.9, open-vm-tools-test 11.0.5-3.el7_9.9, open-vm-tools-desktop 11.0.5-3.el7_9.9
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 20 mo ago
Exploit prediction
0.40% chance of exploitation in the next 30 days, higher than 34% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- openwall.com https://www.openwall.com/lists/oss-security/2023/10/27/3 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.4 | CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 7.0 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected products
- n/a open-vm-tools
Classification
- Weakness
-
- CWE-404 Improper Resource Shutdown or Release
References
-
openwall.com
/lists/oss-security/2023/10/27/2
mailing-list, patch, third-party-advisory
-
openwall.com
/lists/oss-security/2023/10/27/3
exploit
-
vmware.com
/security/advisories/VMSA-2023-0024.html
not-applicable
-
openwall.com
/lists/oss-security/2023/10/27/3
mailing-list, third-party-advisory
-
debian.org
/security/2023/dsa-5543
third-party-advisory
-
lists.debian.org
/debian-lts-announce/2023/11/msg00002.html
mailing-list, third-party-advisory
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/WLTKVTRKQW2GD2274H3UOW6XU4E62GSK/
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/G7G77Z76CQPGUF7VHRA6O3UFCMPPR4O2/
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/MQUOFQL2SNNNMKROQ3TZQY4HEYMNOIBW/
- openwall.com /lists/oss-security/2023/11/26/1
- openwall.com /lists/oss-security/2023/11/27/1
Sources
- CVE List CVE-2023-34059
- NVD CVE-2023-34059
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.