CVE-2022-22938: VMware Workstation DoS Vulnerability

CVE-2022-22938 Overview

CVE-2022-22938 is a denial-of-service vulnerability affecting VMware Workstation and Horizon Client for Windows. The vulnerability exists within the Cortado ThinPrint component, specifically in the TrueType font parser. A malicious actor with access to a virtual machine or remote desktop session can exploit this issue to trigger a denial-of-service condition in the ThinPrint service running on the host machine where VMware Workstation or Horizon Client for Windows is installed.

Critical Impact

An attacker with VM or remote desktop access can crash the ThinPrint service on the host machine, disrupting printing capabilities and potentially impacting system availability across the virtualization environment.

Affected Products

• VMware Workstation 16.x prior to 16.2.2
• VMware Horizon Client for Windows 5.x prior to 5.5.3
• Microsoft Windows (as the host operating system)

Discovery Timeline

• 2022-01-28 - CVE-2022-22938 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-22938

Vulnerability Analysis

This vulnerability resides in the Cortado ThinPrint component, a virtual printing solution that enables printing from virtual machines to physical printers connected to the host system. The flaw specifically affects the TrueType font parser within the ThinPrint service.

When processing specially crafted TrueType font data, the parser fails to properly handle malformed input, leading to a service crash. The attack requires local access, meaning an attacker must have access to a guest virtual machine or a remote desktop session to exploit the vulnerability. The scope is changed, indicating that while the vulnerability is exploited within the VM context, the impact extends to the host machine running the ThinPrint service.

The vulnerability does not allow data exfiltration or code execution but can disrupt printing operations and potentially affect system stability. In enterprise environments where ThinPrint is widely deployed for virtual desktop infrastructure (VDI), this could impact multiple users relying on virtual printing capabilities.

Root Cause

The root cause of CVE-2022-22938 lies in improper input validation within the TrueType font parsing logic of the Cortado ThinPrint component. The parser does not adequately validate font data structures before processing, allowing malformed font files to trigger an unhandled exception or resource exhaustion condition that crashes the service.

TrueType fonts contain complex binary structures including glyph definitions, hinting instructions, and metadata tables. Without proper bounds checking and format validation, a specially crafted font can cause the parser to enter an invalid state, resulting in denial of service.

Attack Vector

The attack vector for CVE-2022-22938 is local, requiring the attacker to have access to a guest VM or remote desktop session connected to a vulnerable host. The exploitation scenario involves:

1. An attacker gains access to a virtual machine running on a VMware Workstation host or connects via Horizon Client
2. The attacker triggers a print operation using a document containing malicious TrueType font data
3. The ThinPrint service on the host attempts to parse the font data
4. The malformed font causes the parser to crash, resulting in denial of service

The attack does not require elevated privileges within the guest VM (low privilege requirement) and requires no user interaction beyond the initial VM access. The exploitation can be repeated to persistently deny printing services.

Detection Methods for CVE-2022-22938

Indicators of Compromise

• Unexpected crashes or restarts of the ThinPrint service (TPAutoConnSvc.exe or related processes)
• Event log entries indicating ThinPrint service failures or application errors
• Unusual print job submissions containing embedded or non-standard TrueType fonts
• Multiple service recovery attempts within a short timeframe

Detection Strategies

• Monitor Windows Event Logs for Application Errors related to ThinPrint components
• Configure service monitoring to alert on repeated ThinPrint service crashes
• Implement endpoint detection rules to identify suspicious font file processing activity
• Review print spooler and ThinPrint logs for anomalous print job patterns

Monitoring Recommendations

• Enable detailed logging for ThinPrint services on VMware Workstation and Horizon Client hosts
• Set up alerts for service availability of ThinPrint components using system monitoring tools
• Implement SentinelOne's Singularity platform to detect abnormal process behavior and service crashes
• Monitor for repeated restart patterns of TPAutoConnSvc.exe and related ThinPrint processes

How to Mitigate CVE-2022-22938

Immediate Actions Required

• Upgrade VMware Workstation to version 16.2.2 or later
• Upgrade VMware Horizon Client for Windows to version 5.5.3 or later
• If patching is not immediately possible, consider disabling the ThinPrint feature as a temporary workaround
• Restrict VM access to trusted users only to minimize the attack surface

Patch Information

VMware has released security updates to address this vulnerability. Detailed patch information is available in the VMware Security Advisory VMSA-2022-0002. Organizations should prioritize updating affected VMware products to the fixed versions:

• VMware Workstation: Update to version 16.2.2 or later
• VMware Horizon Client for Windows: Update to version 5.5.3 or later

Workarounds

• Disable the ThinPrint component in VMware Workstation or Horizon Client settings if virtual printing is not required
• Restrict network access to virtual machines to limit potential attacker access
• Implement strict access controls for virtual desktop infrastructure environments
• Use SentinelOne Singularity to monitor for service crashes and anomalous behavior that may indicate exploitation attempts

# Disable ThinPrint in VMware Workstation
# Edit the VMware Workstation preferences file or use the GUI:
# Edit -> Preferences -> Devices -> Disable "Enable virtual printers"

# Alternatively, stop and disable the ThinPrint service on Windows hosts:
sc stop TPAutoConnSvc
sc config TPAutoConnSvc start= disabled