CVE-2022-22962: VMware Horizon Privilege Escalation Flaw

CVE-2022-22962 Overview

CVE-2022-22962 is a local privilege escalation vulnerability affecting VMware Horizon Agent for Linux versions prior to 22.x. The vulnerability exists because a user is able to change the default shared folder location through manipulation of a vulnerable symbolic link. Successful exploitation can result in linking to a root-owned file, allowing an attacker with local access to escalate their privileges on the affected system.

Critical Impact

A local attacker with low privileges can exploit this symlink vulnerability to gain access to root-owned files, potentially leading to complete system compromise through privilege escalation.

Affected Products

• VMware Horizon Agent for Linux (versions prior to 22.x)
• Linux systems running vulnerable VMware Horizon Agent

Discovery Timeline

• April 11, 2022 - CVE-2022-22962 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2022-22962

Vulnerability Analysis

This vulnerability is classified as CWE-59 (Improper Link Resolution Before File Access), commonly known as a symlink attack or symbolic link following vulnerability. The VMware Horizon Agent for Linux contains a flaw in how it handles the default shared folder location, allowing an unprivileged local user to manipulate symbolic links to redirect file operations.

The attack requires local access to the target system with low-level privileges. Once exploited, the attacker can leverage the vulnerable symlink handling to gain access to files owned by the root user. This type of vulnerability is particularly dangerous in multi-tenant environments or systems where multiple users have local access, as it can serve as a stepping stone for full system compromise.

Root Cause

The root cause of this vulnerability lies in improper validation of symbolic links when the VMware Horizon Agent processes the shared folder location. The application fails to properly verify that the target of a symbolic link is an authorized location before performing file operations. This allows an attacker to create a malicious symlink that points to sensitive root-owned files, causing the privileged Horizon Agent process to inadvertently interact with these protected resources.

Attack Vector

The attack vector is local, requiring the attacker to have an authenticated session on the target Linux system. The exploitation process involves the following mechanism:

1. The attacker identifies the shared folder location used by VMware Horizon Agent
2. The attacker creates a symbolic link in place of the expected folder, pointing to a root-owned file or directory
3. When the VMware Horizon Agent performs operations on the shared folder, it follows the symlink
4. The agent, running with elevated privileges, performs actions on the root-owned target
5. This results in unauthorized access or modification of privileged system resources

The vulnerability does not require user interaction beyond the attacker having local access. This symlink attack technique is well-documented in Unix/Linux environments and can be particularly effective against services that run with elevated privileges while processing user-controlled paths.

Detection Methods for CVE-2022-22962

Indicators of Compromise

• Unusual symbolic links created in VMware Horizon Agent shared folder locations
• Unexpected file operations or access attempts on root-owned files by the Horizon Agent process
• Anomalous permission changes or file modifications in system directories
• Log entries indicating the Horizon Agent accessing files outside its normal operational scope

Detection Strategies

• Monitor for symbolic link creation in VMware Horizon Agent directories using file integrity monitoring tools
• Implement auditd rules to track symlink operations targeting sensitive system files
• Deploy endpoint detection solutions to identify privilege escalation patterns on Linux systems
• Review VMware Horizon Agent logs for unusual shared folder path operations

Monitoring Recommendations

• Configure SentinelOne to monitor for symlink-based privilege escalation attempts on Linux endpoints
• Establish baseline behavior for VMware Horizon Agent file operations to detect anomalies
• Implement real-time alerting for any process attempting to follow symlinks to root-owned files
• Enable comprehensive audit logging on systems running VMware Horizon Agent

How to Mitigate CVE-2022-22962

Immediate Actions Required

• Update VMware Horizon Agent for Linux to version 22.x or later immediately
• Audit systems running affected versions for signs of exploitation
• Restrict local access to systems running VMware Horizon Agent where possible
• Implement additional access controls on sensitive system files and directories

Patch Information

VMware has addressed this vulnerability in VMware Horizon Agent for Linux version 22.x and later. Organizations should apply the security update as documented in VMware Security Advisory VMSA-2022-0012. The patch implements proper validation of symbolic links before file access operations, preventing the exploitation of this vulnerability.

Workarounds

• Restrict local user access to systems running vulnerable versions of VMware Horizon Agent
• Implement strict file permission controls on the shared folder location used by the agent
• Use mandatory access control systems (SELinux, AppArmor) to limit the Horizon Agent's file access scope
• Monitor and alert on symbolic link creation in Horizon Agent operational directories

# Example: Restrict permissions on Horizon Agent directories
# Check current shared folder permissions
ls -la /path/to/horizon/shared

# Ensure proper ownership and restrict symlink creation
chown root:root /path/to/horizon/shared
chmod 755 /path/to/horizon/shared

# Enable audit logging for symlink operations
auditctl -w /path/to/horizon/shared -p wa -k horizon_symlink_monitor