VMware Tools for Windows: improper authorisation lets a guest user reach other guest VMs on the same vCenter or ESX

Impact

A non-administrative user inside a Windows guest who is already authenticated to vCenter or ESX can use VMware Tools to operate against other guest VMs instead of only their own. On a shared virtualized fleet that is a tenant-boundary crossing: the isolation an operator sells is per-VM, and this lets one VM's occupant act inside another. Exploitation still requires valid credentials for the target VMs and for vCenter or ESX, which is what keeps the score below critical. The flaw is in the guest agent, not the hypervisor itself, so it does not by itself yield host compromise.

Who can reach it

A local, non-administrative user in a Windows guest who also holds vCenter or ESX credentials and credentials for the targeted VMs. Authentication is required at every step.

What to do

Update VMware Tools in the affected Windows guests to the fixed release listed in the Broadcom advisory; this is a per-guest agent update, and VMware Tools upgrades on Windows commonly require a guest reboot, so plan it as a tenant-visible restart rather than a host maintenance window. No host or hypervisor change is called for. Confirm the exact fixed build against the advisory before scheduling, since the record here does not state it.

References

Related entries

• Xen qemu-xen-traditional device model hw/pt-msi.c (MSI-X passthrough): Buffer overflow on the MSI-X table write pathCVE-2015-8554 · Xen qemu-xen-traditional device model hw/pt-msi.c (MSI-X passthrough)High
• Linux kernel RDS net/rds/recv.c - rds_inc_info_copy: A structure member is left uninitialised before the RDS messageCVE-2016-5244 · Linux kernel RDS net/rds/recv.c - rds_inc_info_copyHigh
• OpenSSL: malicious TLS server can hang a client with an oversized DH primeCVE-2018-0732 · OpenSSL (DH/DHE key agreement in the TLS client)High
• OpenSSL: NULL dereference in SSL_check_chain crashes TLS 1.3 peersCVE-2020-1967 · OpenSSL 1.1.1d-1.1.1f (SSL_check_chain, TLS 1.3 signature_algorithms_cert handling)High
• QEMU (virtio-net): Heap use-after-free in virtio_net_receive_rcu - guest-to-host code execution in the QEMU processCVE-2021-3748 · QEMU (virtio-net)High
• Linux kernel (drivers/nvme/target): When the target's peer-to-peer memory pool runs dry, it still tries to return theCVE-2021-47130 · Linux kernel (drivers/nvme/target)High