summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorYi Zhao <yi.zhao@eng.windriver.com>2023-06-29 21:04:15 +0800
committerArmin Kuster <akuster808@gmail.com>2023-07-02 11:24:51 -0400
commit76305fc4c3c841fecdc92ebd8145de1803347b1c (patch)
tree4276dda45fe0f104717394258904267e7fa67665
parentd71a08b3d8fc69d3213c10885af9cc693056a8bd (diff)
downloadmeta-openembedded-76305fc4c3c841fecdc92ebd8145de1803347b1c.tar.gz
open-vm-tools: Security fix CVE-2023-20867
CVE-2023-20867: A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. Reference: https://nvd.nist.gov/vuln/detail/CVE-2023-20867 Patch from: https://github.com/vmware/open-vm-tools/blob/CVE-2023-20867.patch/2023-20867-Remove-some-dead-code.patch Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
Diffstat
-rw-r--r--meta-networking/recipes-support/open-vm-tools/open-vm-tools/CVE-2023-20867.patch163
-rw-r--r--meta-networking/recipes-support/open-vm-tools/open-vm-tools_12.1.5.bb1
2 files changed, 164 insertions, 0 deletions
diff --git a/meta-networking/recipes-support/open-vm-tools/open-vm-tools/CVE-2023-20867.patch b/meta-networking/recipes-support/open-vm-tools/open-vm-tools/CVE-2023-20867.patch
new file mode 100644
index 0000000000..170dddf688
--- /dev/null
+++ b/meta-networking/recipes-support/open-vm-tools/open-vm-tools/CVE-2023-20867.patch
@@ -0,0 +1,163 @@
1From 3028cdd4c0b2461b904cbe5a5868c8e591aa0941 Mon Sep 17 00:00:00 2001
2From: John Wolfe <jwolfe@vmware.com>
3Date: Mon, 8 May 2023 19:04:57 -0700
4Subject: [PATCH] Remove some dead code.
5
6Address CVE-2023-20867.
7Remove some authentication types which were deprecated long
8ago and are no longer in use. These are dead code.
9
10CVE: CVE-2023-20867
11
12Upstream-Status: Backport
13[https://github.com/vmware/open-vm-tools/blob/CVE-2023-20867.patch/2023-20867-Remove-some-dead-code.patch]
14
15Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
16---
17 open-vm-tools/services/plugins/vix/vixTools.c | 102 --------------------------
18 1 file changed, 102 deletions(-)
19
20diff --git a/open-vm-tools/services/plugins/vix/vixTools.c b/open-vm-tools/services/plugins/vix/vixTools.c
21index 9f376a7..85c5ba7 100644
22--- a/open-vm-tools/services/plugins/vix/vixTools.c
23+++ b/open-vm-tools/services/plugins/vix/vixTools.c
24@@ -254,8 +254,6 @@ char *gImpersonatedUsername = NULL;
25 #define VIX_TOOLS_CONFIG_API_AUTHENTICATION "Authentication"
26 #define VIX_TOOLS_CONFIG_AUTHTYPE_AGENTS "InfrastructureAgents"
27
28-#define VIX_TOOLS_CONFIG_INFRA_AGENT_DISABLED_DEFAULT TRUE
29-
30 /*
31 * The switch that controls all APIs
32 */
33@@ -730,9 +728,6 @@ VixError GuestAuthSAMLAuthenticateAndImpersonate(
34
35 void GuestAuthUnimpersonate();
36
37-static Bool VixToolsCheckIfAuthenticationTypeEnabled(GKeyFile *confDictRef,
38- const char *typeName);
39-
40 #if SUPPORT_VGAUTH
41
42 VGAuthError TheVGAuthContext(VGAuthContext **ctx);
43@@ -8013,29 +8008,6 @@ VixToolsImpersonateUser(VixCommandRequestHeader *requestMsg, // IN
44 userToken);
45 break;
46 }
47- case VIX_USER_CREDENTIAL_ROOT:
48- {
49- if ((requestMsg->requestFlags & VIX_REQUESTMSG_HAS_HASHED_SHARED_SECRET) &&
50- !VixToolsCheckIfAuthenticationTypeEnabled(gConfDictRef,
51- VIX_TOOLS_CONFIG_AUTHTYPE_AGENTS)) {
52- /*
53- * Don't accept hashed shared secret if disabled.
54- */
55- g_message("%s: Requested authentication type has been disabled.\n",
56- __FUNCTION__);
57- err = VIX_E_GUEST_AUTHTYPE_DISABLED;
58- goto done;
59- }
60- }
61- // fall through
62-
63- case VIX_USER_CREDENTIAL_CONSOLE_USER:
64- err = VixToolsImpersonateUserImplEx(NULL,
65- credentialType,
66- NULL,
67- loadUserProfile,
68- userToken);
69- break;
70 case VIX_USER_CREDENTIAL_NAME_PASSWORD:
71 case VIX_USER_CREDENTIAL_NAME_PASSWORD_OBFUSCATED:
72 case VIX_USER_CREDENTIAL_NAMED_INTERACTIVE_USER:
73@@ -8205,36 +8177,6 @@ VixToolsImpersonateUserImplEx(char const *credentialTypeStr, // IN
74 }
75
76 /*
77- * If the VMX asks to be root, then we allow them.
78- * The VMX will make sure that only it will pass this value in,
79- * and only when the VM and host are configured to allow this.
80- */
81- if ((VIX_USER_CREDENTIAL_ROOT == credentialType)
82- && (thisProcessRunsAsRoot)) {
83- *userToken = PROCESS_CREATOR_USER_TOKEN;
84-
85- gImpersonatedUsername = Util_SafeStrdup("_ROOT_");
86- err = VIX_OK;
87- goto quit;
88- }
89-
90- /*
91- * If the VMX asks to be root, then we allow them.
92- * The VMX will make sure that only it will pass this value in,
93- * and only when the VM and host are configured to allow this.
94- *
95- * XXX This has been deprecated XXX
96- */
97- if ((VIX_USER_CREDENTIAL_CONSOLE_USER == credentialType)
98- && ((allowConsoleUserOps) || !(thisProcessRunsAsRoot))) {
99- *userToken = PROCESS_CREATOR_USER_TOKEN;
100-
101- gImpersonatedUsername = Util_SafeStrdup("_CONSOLE_USER_NAME_");
102- err = VIX_OK;
103- goto quit;
104- }
105-
106- /*
107 * If the VMX asks us to run commands in the context of the current
108 * user, make sure that the user who requested the command is the
109 * same as the current user.
110@@ -10917,50 +10859,6 @@ VixToolsCheckIfVixCommandEnabled(int opcode, // IN
111 /*
112 *-----------------------------------------------------------------------------
113 *
114- * VixToolsCheckIfAuthenticationTypeEnabled --
115- *
116- * Checks to see if a given authentication type has been
117- * disabled via the tools configuration.
118- *
119- * Return value:
120- * TRUE if enabled, FALSE otherwise.
121- *
122- * Side effects:
123- * None
124- *
125- *-----------------------------------------------------------------------------
126- */
127-
128-static Bool
129-VixToolsCheckIfAuthenticationTypeEnabled(GKeyFile *confDictRef, // IN
130- const char *typeName) // IN
131-{
132- char authnDisabledName[64]; // Authentication.<AuthenticationType>.disabled
133- gboolean disabled;
134-
135- Str_Snprintf(authnDisabledName, sizeof(authnDisabledName),
136- VIX_TOOLS_CONFIG_API_AUTHENTICATION ".%s.disabled",
137- typeName);
138-
139- ASSERT(confDictRef != NULL);
140-
141- /*
142- * XXX Skip doing the strcmp() to verify the auth type since we only
143- * have the one typeName (VIX_TOOLS_CONFIG_AUTHTYPE_AGENTS), and default
144- * it to VIX_TOOLS_CONFIG_INFRA_AGENT_DISABLED_DEFAULT.
145- */
146- disabled = VMTools_ConfigGetBoolean(confDictRef,
147- VIX_TOOLS_CONFIG_API_GROUPNAME,
148- authnDisabledName,
149- VIX_TOOLS_CONFIG_INFRA_AGENT_DISABLED_DEFAULT);
150-
151- return !disabled;
152-}
153-
154-
155-/*
156- *-----------------------------------------------------------------------------
157- *
158 * VixTools_ProcessVixCommand --
159 *
160 *
161--
1622.6.2
163
diff --git a/meta-networking/recipes-support/open-vm-tools/open-vm-tools_12.1.5.bb b/meta-networking/recipes-support/open-vm-tools/open-vm-tools_12.1.5.bb
index d389d2450c..e12e4be7f8 100644
--- a/meta-networking/recipes-support/open-vm-tools/open-vm-tools_12.1.5.bb
+++ b/meta-networking/recipes-support/open-vm-tools/open-vm-tools_12.1.5.bb
@@ -43,6 +43,7 @@ SRC_URI = "git://github.com/vmware/open-vm-tools.git;protocol=https;branch=stabl
43 file://0012-hgfsServerLinux-Consider-64bit-time_t-possibility.patch;patchdir=.. \ 43 file://0012-hgfsServerLinux-Consider-64bit-time_t-possibility.patch;patchdir=.. \
44 file://0013-open-vm-tools-Correct-include-path-for-poll.h.patch;patchdir=.. \ 44 file://0013-open-vm-tools-Correct-include-path-for-poll.h.patch;patchdir=.. \
45 file://0001-timeSync-Portable-way-to-print-64bit-time_t.patch;patchdir=.. \ 45 file://0001-timeSync-Portable-way-to-print-64bit-time_t.patch;patchdir=.. \
46 file://CVE-2023-20867.patch;patchdir=.. \
46 " 47 "
47 48
48UPSTREAM_CHECK_GITTAGREGEX = "stable-(?P<pver>\d+(\.\d+)+)" 49UPSTREAM_CHECK_GITTAGREGEX = "stable-(?P<pver>\d+(\.\d+)+)"
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-06-14 10:40:49 +0000