CVE-2022-22964: VMware Horizon Privilege Escalation Flaw

CVE-2022-22964 Overview

CVE-2022-22964 is a local privilege escalation vulnerability affecting VMware Horizon Agent for Linux prior to version 22.x. This vulnerability allows an authenticated local user to escalate privileges to root due to a vulnerable configuration file. The flaw exists in how the Horizon Agent handles configuration file permissions, enabling attackers with low-privilege access to manipulate configuration settings and achieve root-level access on affected Linux systems.

Critical Impact
Local attackers can escalate privileges from a standard user account to root, gaining complete control over the affected Linux system running VMware Horizon Agent.

Affected Products

VMware Horizon Agent for Linux (versions prior to 22.x)
Linux systems running vulnerable Horizon Agent configurations
VMware Horizon virtual desktop infrastructure environments

Discovery Timeline

2022-04-11 - CVE-2022-22964 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-22964

Vulnerability Analysis

This privilege escalation vulnerability stems from insecure configuration file handling within the VMware Horizon Agent for Linux. The vulnerability allows a local user with low privileges to exploit the misconfigured file to gain elevated root privileges. The attack requires local access to the system but does not require user interaction, making it particularly dangerous in multi-user environments or compromised systems where attackers have established an initial foothold.

The vulnerability impacts the confidentiality, integrity, and availability of affected systems, as successful exploitation grants attackers complete administrative control over the host operating system.

Root Cause

The root cause of CVE-2022-22964 lies in a vulnerable configuration file used by the VMware Horizon Agent for Linux. The configuration file contains improper permission settings or can be manipulated by non-privileged users, allowing them to inject malicious configurations that execute with elevated privileges when the Horizon Agent service processes the configuration.

This type of vulnerability typically occurs when configuration files are:

World-writable or group-writable by non-privileged users
Located in directories where unprivileged users can create symlinks
Processed without adequate validation of content or ownership

Attack Vector

The attack vector for CVE-2022-22964 is local, requiring the attacker to have authenticated access to the Linux system running the vulnerable Horizon Agent. The exploitation process generally involves:

The attacker gains initial access to the system as a low-privileged user
The attacker identifies and modifies the vulnerable configuration file
The Horizon Agent service processes the malicious configuration
The attacker's payload executes with root privileges

The vulnerability can be exploited as part of a privilege escalation chain, where attackers first compromise a user account through other means (phishing, credential theft, or another vulnerability) and then use CVE-2022-22964 to gain root access.

Detection Methods for CVE-2022-22964

Indicators of Compromise

Unexpected modifications to VMware Horizon Agent configuration files
Suspicious processes spawned by the Horizon Agent service running as root
Unusual file permission changes on Horizon Agent configuration directories
Anomalous user activity from low-privileged accounts attempting to access Horizon configuration files

Detection Strategies

Monitor file integrity of VMware Horizon Agent configuration files using tools like AIDE or Tripwire
Implement audit logging for file access and modifications on /etc/vmware/ and related Horizon Agent directories
Deploy endpoint detection and response (EDR) solutions to detect privilege escalation attempts
Review system logs for unexpected root shell spawns or privilege elevation events

Monitoring Recommendations

Enable detailed auditd logging for configuration file access patterns
Configure SIEM rules to alert on suspicious file modifications to Horizon Agent components
Monitor for unusual process hierarchies where Horizon Agent services spawn unexpected child processes
Implement user behavior analytics to detect anomalous local user activity

How to Mitigate CVE-2022-22964

Immediate Actions Required

Update VMware Horizon Agent for Linux to version 22.x or later immediately
Audit current Horizon Agent deployments to identify vulnerable installations
Review and restrict file permissions on Horizon Agent configuration files
Implement the principle of least privilege for all user accounts on affected systems

Patch Information

VMware has released security updates to address this vulnerability. Organizations should apply the patches available through VMware Security Advisory VMSA-2022-0012. The recommended remediation is to upgrade the VMware Horizon Agent for Linux to version 22.x or later, which contains the fix for this privilege escalation vulnerability.

Workarounds

Restrict local access to systems running vulnerable Horizon Agent versions
Implement strict file permission controls on Horizon Agent configuration directories
Use mandatory access control systems like SELinux or AppArmor to limit Horizon Agent file access
Monitor and audit all local user activity on affected systems until patches can be applied

bash

# Verify current Horizon Agent version
rpm -qa | grep -i horizon

# Check configuration file permissions (review for overly permissive settings)
ls -la /etc/vmware/

# Ensure proper ownership of configuration files
chown root:root /etc/vmware/config
chmod 644 /etc/vmware/config