7.8 CVE-2025-41244

Privilege Escalation
 

VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.
https://nvd.nist.gov/vuln/detail/CVE-2025-41244

Categories

CWE-267 : Privilege Defined With Unsafe Actions
A particular privilege, role, capability, or right can be used to perform unsafe actions that were not intended, even when it is assigned to the correct entity. Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software. Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations. Roles have access to dangerous procedures (Accessible entities). Untrusted object/method gets access to clipboard (Accessible entities). Gain privileges using functions/tags that should be restricted (Accessible entities). Traceroute program allows unprivileged users to modify source address of packet (Accessible entities). Bypass domain restrictions using a particular file that references unsafe URI schemes (Accessible entities). Script does not restrict access to an update command, leading to resultant disk consumption and filled error logs (Accessible entities). "public" database user can use stored procedure to modify data controlled by the database owner (Unsafe privileged actions). User with capability can prevent setuid program from dropping privileges (Unsafe privileged actions). Allows attachment to and modification of privileged processes (Unsafe privileged actions). User with privilege can edit raw underlying object using unprotected method (Unsafe privileged actions). Inappropriate actions allowed by a particular role(Unsafe privileged actions). Untrusted entity allowed to access the system clipboard (Unsafe privileged actions). Extra Linux capability allows bypass of system-specified restriction (Unsafe privileged actions). User with debugging rights can read entire process (Unsafe privileged actions). Non-root admins can add themselves or others to the root admin group (Unsafe privileged actions). Users can change certain properties of objects to perform otherwise unauthorized actions (Unsafe privileged actions). Certain debugging commands not restricted to just the administrator, allowing registry modification and infoleak (Unsafe privileged actions).

References


 

CPE

cpe start end

REMEDIATION


EXPLOITS

Exploit-db.com

id description date
No known exploits

POC Github

Url
No known exploits

Other Nist (github, ...)

Url
No known exploits

CAPEC

Common Attack Pattern Enumerations and Classifications

id description severity
58 Restful Privilege Elevation
High
634 Probe Audio and Video Peripherals
High
637 Collect Data from Clipboard
Low
643 Identify Shared Files/Directories on System
Medium
648 Collect Data from Screen Capture
Medium

MITRE

Techniques

id description
T1113 Screen Capture
T1115 Clipboard Data
T1123 Audio Capture
T1125 Video Capture
T1135 Network Share Discovery
T1513 Screen Capture
© 2022 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.

Mitigations

id description
M1028 Enable Windows Group Policy “Do Not Allow Anonymous Enumeration of SAM Accounts and Shares” security setting to limit users who can enumerate network shares.
© 2022 The MITRE Corporation. Esta obra se reproduce y distribuye con el permiso de The MITRE Corporation.