CVE-2022-22964: VMware Horizon Privilege Escalation Flaw

CVE-2022-22964 Overview

CVE-2022-22964 is a local privilege escalation vulnerability affecting VMware Horizon Agent for Linux prior to version 22.x. This vulnerability allows an authenticated local user to escalate privileges to root due to a vulnerable configuration file. The flaw exists in how the Horizon Agent handles configuration file permissions, enabling attackers with low-privilege access to manipulate configuration settings and achieve root-level access on affected Linux systems.

Critical Impact

Local attackers can escalate privileges from a standard user account to root, gaining complete control over the affected Linux system running VMware Horizon Agent.

Affected Products

• VMware Horizon Agent for Linux (versions prior to 22.x)
• Linux systems running vulnerable Horizon Agent configurations
• VMware Horizon virtual desktop infrastructure environments

Discovery Timeline

• 2022-04-11 - CVE-2022-22964 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-22964

Vulnerability Analysis

This privilege escalation vulnerability stems from insecure configuration file handling within the VMware Horizon Agent for Linux. The vulnerability allows a local user with low privileges to exploit the misconfigured file to gain elevated root privileges. The attack requires local access to the system but does not require user interaction, making it particularly dangerous in multi-user environments or compromised systems where attackers have established an initial foothold.

The vulnerability impacts the confidentiality, integrity, and availability of affected systems, as successful exploitation grants attackers complete administrative control over the host operating system.

Root Cause

The root cause of CVE-2022-22964 lies in a vulnerable configuration file used by the VMware Horizon Agent for Linux. The configuration file contains improper permission settings or can be manipulated by non-privileged users, allowing them to inject malicious configurations that execute with elevated privileges when the Horizon Agent service processes the configuration.

This type of vulnerability typically occurs when configuration files are:

• World-writable or group-writable by non-privileged users
• Located in directories where unprivileged users can create symlinks
• Processed without adequate validation of content or ownership

Attack Vector

The attack vector for CVE-2022-22964 is local, requiring the attacker to have authenticated access to the Linux system running the vulnerable Horizon Agent. The exploitation process generally involves:

1. The attacker gains initial access to the system as a low-privileged user
2. The attacker identifies and modifies the vulnerable configuration file
3. The Horizon Agent service processes the malicious configuration
4. The attacker's payload executes with root privileges

The vulnerability can be exploited as part of a privilege escalation chain, where attackers first compromise a user account through other means (phishing, credential theft, or another vulnerability) and then use CVE-2022-22964 to gain root access.

Detection Methods for CVE-2022-22964

Indicators of Compromise

• Unexpected modifications to VMware Horizon Agent configuration files
• Suspicious processes spawned by the Horizon Agent service running as root
• Unusual file permission changes on Horizon Agent configuration directories
• Anomalous user activity from low-privileged accounts attempting to access Horizon configuration files

Detection Strategies

• Monitor file integrity of VMware Horizon Agent configuration files using tools like AIDE or Tripwire
• Implement audit logging for file access and modifications on /etc/vmware/ and related Horizon Agent directories
• Deploy endpoint detection and response (EDR) solutions to detect privilege escalation attempts
• Review system logs for unexpected root shell spawns or privilege elevation events

Monitoring Recommendations

• Enable detailed auditd logging for configuration file access patterns
• Configure SIEM rules to alert on suspicious file modifications to Horizon Agent components
• Monitor for unusual process hierarchies where Horizon Agent services spawn unexpected child processes
• Implement user behavior analytics to detect anomalous local user activity

How to Mitigate CVE-2022-22964

Immediate Actions Required

• Update VMware Horizon Agent for Linux to version 22.x or later immediately
• Audit current Horizon Agent deployments to identify vulnerable installations
• Review and restrict file permissions on Horizon Agent configuration files
• Implement the principle of least privilege for all user accounts on affected systems

Patch Information

VMware has released security updates to address this vulnerability. Organizations should apply the patches available through VMware Security Advisory VMSA-2022-0012. The recommended remediation is to upgrade the VMware Horizon Agent for Linux to version 22.x or later, which contains the fix for this privilege escalation vulnerability.

Workarounds

• Restrict local access to systems running vulnerable Horizon Agent versions
• Implement strict file permission controls on Horizon Agent configuration directories
• Use mandatory access control systems like SELinux or AppArmor to limit Horizon Agent file access
• Monitor and audit all local user activity on affected systems until patches can be applied

# Verify current Horizon Agent version
rpm -qa | grep -i horizon

# Check configuration file permissions (review for overly permissive settings)
ls -la /etc/vmware/

# Ensure proper ownership of configuration files
chown root:root /etc/vmware/config
chmod 644 /etc/vmware/config