summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMeenali Gupta <meenali.gupta@windriver.com>2023-10-05 07:14:31 +0000
committerArmin Kuster <akuster808@gmail.com>2023-10-17 08:44:17 -0400
commite2b534cc3a9f178b909c1e15c4b5919c7c0395db (patch)
treede5ca6b08f4d1b11f7a112919b8766d569365e8c
parentbaf6153112e416cf2fe05351a1b007d88f0ef1a4 (diff)
downloadmeta-openembedded-e2b534cc3a9f178b909c1e15c4b5919c7c0395db.tar.gz
open-vm-tools: fix CVE-2023-20867
A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. Signed-off-by: Meenali Gupta <meenali.gupta@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
Diffstat
-rw-r--r--meta-networking/recipes-support/open-vm-tools/open-vm-tools/CVE-2023-20867.patch158
-rw-r--r--meta-networking/recipes-support/open-vm-tools/open-vm-tools_11.3.5.bb1
2 files changed, 159 insertions, 0 deletions
diff --git a/meta-networking/recipes-support/open-vm-tools/open-vm-tools/CVE-2023-20867.patch b/meta-networking/recipes-support/open-vm-tools/open-vm-tools/CVE-2023-20867.patch
new file mode 100644
index 0000000000..071ddf45d1
--- /dev/null
+++ b/meta-networking/recipes-support/open-vm-tools/open-vm-tools/CVE-2023-20867.patch
@@ -0,0 +1,158 @@
1From 32fe1b6ac239255a91020020510453685459b28a Mon Sep 17 00:00:00 2001
2From: John Wolfe <jwolfe@vmware.com>
3Date: Mon, 8 May 2023 19:04:57 -0700
4Subject: [PATCH] open-vm-tools: Remove some dead code.
5
6Address CVE-2023-20867.
7Remove some authentication types which were deprecated long
8ago and are no longer in use. These are dead code.
9
10Upstream-Status: Backport [https://github.com/vmware/open-vm-tools/blob/CVE-2023-20867.patch/2023-20867-Remove-some-dead-code.patch]
11CVE: CVE-2023-20867
12
13Signed-off-by: Meenali Gupta <meenali.gupta@windriver.com>
14---
15 open-vm-tools/services/plugins/vix/vixTools.c | 100 ------------------
16 1 file changed, 100 deletions(-)
17
18diff --git a/open-vm-tools/services/plugins/vix/vixTools.c b/open-vm-tools/services/plugins/vix/vixTools.c
19index bde74021..6e51d1f4 100644
20--- a/open-vm-tools/services/plugins/vix/vixTools.c
21+++ b/open-vm-tools/services/plugins/vix/vixTools.c
22@@ -254,7 +254,6 @@ char *gImpersonatedUsername = NULL;
23 #define VIX_TOOLS_CONFIG_API_AUTHENTICATION "Authentication"
24 #define VIX_TOOLS_CONFIG_AUTHTYPE_AGENTS "InfrastructureAgents"
25
26-#define VIX_TOOLS_CONFIG_INFRA_AGENT_DISABLED_DEFAULT TRUE
27
28 /*
29 * The switch that controls all APIs
30@@ -730,8 +729,6 @@ VixError GuestAuthSAMLAuthenticateAndImpersonate(
31
32 void GuestAuthUnimpersonate();
33
34-static Bool VixToolsCheckIfAuthenticationTypeEnabled(GKeyFile *confDictRef,
35- const char *typeName);
36
37 #if SUPPORT_VGAUTH
38
39@@ -7913,29 +7910,6 @@ VixToolsImpersonateUser(VixCommandRequestHeader *requestMsg, // IN
40 userToken);
41 break;
42 }
43- case VIX_USER_CREDENTIAL_ROOT:
44- {
45- if ((requestMsg->requestFlags & VIX_REQUESTMSG_HAS_HASHED_SHARED_SECRET) &&
46- !VixToolsCheckIfAuthenticationTypeEnabled(gConfDictRef,
47- VIX_TOOLS_CONFIG_AUTHTYPE_AGENTS)) {
48- /*
49- * Don't accept hashed shared secret if disabled.
50- */
51- g_message("%s: Requested authentication type has been disabled.\n",
52- __FUNCTION__);
53- err = VIX_E_GUEST_AUTHTYPE_DISABLED;
54- goto done;
55- }
56- }
57- // fall through
58-
59- case VIX_USER_CREDENTIAL_CONSOLE_USER:
60- err = VixToolsImpersonateUserImplEx(NULL,
61- credentialType,
62- NULL,
63- loadUserProfile,
64- userToken);
65- break;
66 case VIX_USER_CREDENTIAL_NAME_PASSWORD:
67 case VIX_USER_CREDENTIAL_NAME_PASSWORD_OBFUSCATED:
68 case VIX_USER_CREDENTIAL_NAMED_INTERACTIVE_USER:
69@@ -8104,36 +8078,6 @@ VixToolsImpersonateUserImplEx(char const *credentialTypeStr, // IN
70 }
71 }
72
73- /*
74- * If the VMX asks to be root, then we allow them.
75- * The VMX will make sure that only it will pass this value in,
76- * and only when the VM and host are configured to allow this.
77- */
78- if ((VIX_USER_CREDENTIAL_ROOT == credentialType)
79- && (thisProcessRunsAsRoot)) {
80- *userToken = PROCESS_CREATOR_USER_TOKEN;
81-
82- gImpersonatedUsername = Util_SafeStrdup("_ROOT_");
83- err = VIX_OK;
84- goto quit;
85- }
86-
87- /*
88- * If the VMX asks to be root, then we allow them.
89- * The VMX will make sure that only it will pass this value in,
90- * and only when the VM and host are configured to allow this.
91- *
92- * XXX This has been deprecated XXX
93- */
94- if ((VIX_USER_CREDENTIAL_CONSOLE_USER == credentialType)
95- && ((allowConsoleUserOps) || !(thisProcessRunsAsRoot))) {
96- *userToken = PROCESS_CREATOR_USER_TOKEN;
97-
98- gImpersonatedUsername = Util_SafeStrdup("_CONSOLE_USER_NAME_");
99- err = VIX_OK;
100- goto quit;
101- }
102-
103 /*
104 * If the VMX asks us to run commands in the context of the current
105 * user, make sure that the user who requested the command is the
106@@ -10814,50 +10758,6 @@ VixToolsCheckIfVixCommandEnabled(int opcode, // IN
107 }
108
109
110-/*
111- *-----------------------------------------------------------------------------
112- *
113- * VixToolsCheckIfAuthenticationTypeEnabled --
114- *
115- * Checks to see if a given authentication type has been
116- * disabled via the tools configuration.
117- *
118- * Return value:
119- * TRUE if enabled, FALSE otherwise.
120- *
121- * Side effects:
122- * None
123- *
124- *-----------------------------------------------------------------------------
125- */
126-
127-static Bool
128-VixToolsCheckIfAuthenticationTypeEnabled(GKeyFile *confDictRef, // IN
129- const char *typeName) // IN
130-{
131- char authnDisabledName[64]; // Authentication.<AuthenticationType>.disabled
132- gboolean disabled;
133-
134- Str_Snprintf(authnDisabledName, sizeof(authnDisabledName),
135- VIX_TOOLS_CONFIG_API_AUTHENTICATION ".%s.disabled",
136- typeName);
137-
138- ASSERT(confDictRef != NULL);
139-
140- /*
141- * XXX Skip doing the strcmp() to verify the auth type since we only
142- * have the one typeName (VIX_TOOLS_CONFIG_AUTHTYPE_AGENTS), and default
143- * it to VIX_TOOLS_CONFIG_INFRA_AGENT_DISABLED_DEFAULT.
144- */
145- disabled = VMTools_ConfigGetBoolean(confDictRef,
146- VIX_TOOLS_CONFIG_API_GROUPNAME,
147- authnDisabledName,
148- VIX_TOOLS_CONFIG_INFRA_AGENT_DISABLED_DEFAULT);
149-
150- return !disabled;
151-}
152-
153-
154 /*
155 *-----------------------------------------------------------------------------
156 *
157--
1582.40.0
diff --git a/meta-networking/recipes-support/open-vm-tools/open-vm-tools_11.3.5.bb b/meta-networking/recipes-support/open-vm-tools/open-vm-tools_11.3.5.bb
index 4670a85a67..c80827a992 100644
--- a/meta-networking/recipes-support/open-vm-tools/open-vm-tools_11.3.5.bb
+++ b/meta-networking/recipes-support/open-vm-tools/open-vm-tools_11.3.5.bb
@@ -45,6 +45,7 @@ SRC_URI = "git://github.com/vmware/open-vm-tools.git;protocol=https;branch=maste
45 file://0002-hgfsServerLinux-Consider-64bit-time_t-possibility.patch;patchdir=.. \ 45 file://0002-hgfsServerLinux-Consider-64bit-time_t-possibility.patch;patchdir=.. \
46 file://0001-open-vm-tools-Correct-include-path-for-poll.h.patch;patchdir=.. \ 46 file://0001-open-vm-tools-Correct-include-path-for-poll.h.patch;patchdir=.. \
47 file://0001-Properly-check-authorization-on-incoming-guestOps-re.patch;patchdir=.. \ 47 file://0001-Properly-check-authorization-on-incoming-guestOps-re.patch;patchdir=.. \
48 file://CVE-2023-20867.patch;patchdir=.. \
48 " 49 "
49 50
50UPSTREAM_CHECK_GITTAGREGEX = "stable-(?P<pver>\d+(\.\d+)+)" 51UPSTREAM_CHECK_GITTAGREGEX = "stable-(?P<pver>\d+(\.\d+)+)"
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-02-13 09:49:27 +0000