{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/open-vm-tools/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:vmware:aria_operations:*:*:*:*:*:*:*:*","cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*","cpe:2.3:a:vmware:cloud_foundation_operations:9.0:*:*:*:*:*:*:*","cpe:2.3:a:vmware:open_vm_tools:*:*:*:*:*:*:*:*","cpe:2.3:a:vmware:open_vm_tools:13.0.0:*:*:*:*:*:*:*","cpe:2.3:a:vmware:telco_cloud_infrastructure:*:*:*:*:*:*:*:*","cpe:2.3:a:vmware:telco_cloud_platform:*:*:*:*:*:*:*:*","cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*","cpe:2.3:a:vmware:tools:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.8,"id":"CVE-2025-41244"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["VMware Tools","open-vm-tools"],"_cs_severities":["high"],"_cs_tags":["privilege-escalation","vmware","linux","vulnerability"],"_cs_type":"advisory","_cs_vendors":["VMware"],"content_html":"\u003cp\u003eCVE-2025-41244 is a local privilege escalation (LPE) vulnerability affecting VMware Tools (\u003ccode\u003evmtoolsd\u003c/code\u003e service and its \u003ccode\u003eget-versions.sh\u003c/code\u003e script) on Linux guest operating systems. The vulnerability stems from \u003ccode\u003evmtoolsd\u003c/code\u003e's behavior of executing external utilities (like \u003ccode\u003elsb_release\u003c/code\u003e or \u003ccode\u003erpm\u003c/code\u003e) to determine version strings. A local attacker can exploit this by placing a malicious executable with the same name as a legitimate version utility (e.g., \u003ccode\u003elsb_release\u003c/code\u003e) in a writable location such as \u003ccode\u003e/tmp\u003c/code\u003e and then manipulating the \u003ccode\u003ePATH\u003c/code\u003e environment variable. When \u003ccode\u003evmtoolsd\u003c/code\u003e or \u003ccode\u003eget-versions.sh\u003c/code\u003e is triggered, it will invoke the attacker's malicious binary with elevated privileges (often root), enabling the attacker to gain full control over the compromised virtual machine. This poses a significant risk to Linux-based VMware environments, allowing a low-privileged user to escalate to root.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker gains initial access to a Linux virtual machine as a low-privileged user.\u003c/li\u003e\n\u003cli\u003eThe attacker identifies a world-writable directory on the system, such as \u003ccode\u003e/tmp\u003c/code\u003e, \u003ccode\u003e/var/tmp\u003c/code\u003e, or \u003ccode\u003e/dev/shm\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eA malicious binary is crafted, designed to mimic a legitimate version-checking utility (e.g., \u003ccode\u003elsb_release\u003c/code\u003e, \u003ccode\u003erpm\u003c/code\u003e, \u003ccode\u003edpkg\u003c/code\u003e) and is placed into the identified writable directory.\u003c/li\u003e\n\u003cli\u003eThe attacker modifies the \u003ccode\u003ePATH\u003c/code\u003e environment variable to prepend the writable directory containing the malicious binary, ensuring it takes precedence over the legitimate system binaries.\u003c/li\u003e\n\u003cli\u003eThe attacker then triggers the \u003ccode\u003evmtoolsd\u003c/code\u003e service or the \u003ccode\u003eget-versions.sh\u003c/code\u003e script to perform its routine version information retrieval.\u003c/li\u003e\n\u003cli\u003eDue to the \u003ccode\u003ePATH\u003c/code\u003e manipulation, \u003ccode\u003evmtoolsd\u003c/code\u003e or \u003ccode\u003eget-versions.sh\u003c/code\u003e executes the malicious binary from the writable directory instead of the legitimate system utility.\u003c/li\u003e\n\u003cli\u003eAs \u003ccode\u003evmtoolsd\u003c/code\u003e runs with elevated privileges, the malicious binary is executed with the same high privileges, allowing the attacker to perform arbitrary actions, such as spawning a root shell or creating a new privileged user.\u003c/li\u003e\n\u003cli\u003eThe attacker achieves full local root privileges on the compromised Linux virtual machine.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2025-41244 allows a low-privileged local user to escalate their privileges to root on the affected Linux virtual machine. This grants the attacker complete control over the guest operating system, enabling them to install arbitrary software, modify system configurations, access sensitive data, create new privileged accounts, or establish persistence mechanisms by modifying critical system files like \u003ccode\u003e/etc/sudoers\u003c/code\u003e or \u003ccode\u003e/etc/passwd\u003c/code\u003e. The direct consequence is a severe compromise of the virtual machine's integrity and confidentiality, with potential cascading effects on other systems or data within the organization's infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the provided Sigma rule to your SIEM to detect potential exploitation attempts involving \u003ccode\u003evmtoolsd\u003c/code\u003e or \u003ccode\u003eget-versions.sh\u003c/code\u003e spawning unusual child processes.\u003c/li\u003e\n\u003cli\u003eIsolate any affected VM immediately if the Sigma rule triggers, stop the \u003ccode\u003evmtoolsd\u003c/code\u003e service, and terminate any spawned child processes.\u003c/li\u003e\n\u003cli\u003eRemove any counterfeit or hijacked utilities and symlinks from writable locations like \u003ccode\u003e/tmp\u003c/code\u003e, \u003ccode\u003e/var/tmp\u003c/code\u003e, \u003ccode\u003e/dev/shm\u003c/code\u003e, or user home directories as indicated in the \u0026quot;Investigating Deprecated - Potential CVE-2025-41244 vmtoolsd LPE Exploitation Attempt\u0026quot; section of the brief.\u003c/li\u003e\n\u003cli\u003eHarden Linux hosts by enforcing a safe \u003ccode\u003ePATH\u003c/code\u003e environment variable that only includes trusted system directories and by mounting \u003ccode\u003e/tmp\u003c/code\u003e, \u003ccode\u003e/var/tmp\u003c/code\u003e, \u003ccode\u003e/dev/shm\u003c/code\u003e with \u003ccode\u003enoexec\u003c/code\u003e, \u003ccode\u003enosuid\u003c/code\u003e, and \u003ccode\u003enodev\u003c/code\u003e options.\u003c/li\u003e\n\u003cli\u003eApply the vendor fix for CVE-2025-41244 across all Linux VMs once it becomes available, and ensure \u003ccode\u003eopen-vm-tools\u003c/code\u003e service discovery scripts use absolute paths.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-20T12:40:48Z","date_published":"2026-07-20T12:40:48Z","id":"https://feed.craftedsignal.io/briefs/2026-07-vmware-lpe-cve-2025-41244/","summary":"Attackers can exploit CVE-2025-41244, a local privilege escalation vulnerability in VMware Tools' `vmtoolsd` service and its `get-versions.sh` script on Linux, by manipulating the `PATH` environment variable to execute malicious binaries with elevated privileges when the service attempts to retrieve version information, potentially leading to a root shell.","title":"Potential CVE-2025-41244 vmtoolsd Local Privilege Escalation Attempt","url":"https://feed.craftedsignal.io/briefs/2026-07-vmware-lpe-cve-2025-41244/"}],"language":"en","title":"CraftedSignal Threat Feed - Open-Vm-Tools","version":"https://jsonfeed.org/version/1.1"}