CVE-2022-31693: VMware Tools for Windows DoS Vulnerability

CVE-2022-31693 Overview

CVE-2022-31693 is a denial-of-service vulnerability in the VM3DMP driver shipped with VMware Tools for Windows. The flaw affects VMware Tools versions 12.x.y prior to 12.1.5, as well as all 11.x.y and 10.x.y releases. A local authenticated attacker inside a Windows guest operating system can trigger a kernel PANIC in the driver, causing the guest OS to become unavailable. The issue is classified under [CWE-404] (Improper Resource Shutdown or Release) and was disclosed in VMware Security Advisory VMSA-2022-0029.

Critical Impact

A local user in the Windows guest OS can crash the guest by triggering a PANIC in the VM3DMP driver, resulting in loss of availability for the virtual machine.

Affected Products

• VMware Tools for Windows 12.x.y prior to 12.1.5
• VMware Tools for Windows 11.x.y (all versions)
• VMware Tools for Windows 10.x.y (all versions)

Discovery Timeline

• 2023-06-07 - CVE-2022-31693 published to the National Vulnerability Database (NVD)
• 2025-01-07 - Last updated in NVD database

Technical Details for CVE-2022-31693

Vulnerability Analysis

The vulnerability resides in the VM3DMP kernel-mode driver, a component of VMware Tools that supports virtualized 3D graphics functionality in Windows guests. A local user with standard privileges can issue input that the driver fails to handle safely, leading to a kernel PANIC. The result is a denial-of-service condition affecting the entire Windows guest OS.

The attack requires local access to the guest and low privileges. No user interaction is needed beyond executing the triggering code path. Confidentiality and integrity remain intact, but availability is fully impacted because the guest crashes.

Root Cause

The root cause maps to [CWE-404] Improper Resource Shutdown or Release within the VM3DMP driver. The driver does not properly validate or release resources when processing certain requests originating from user-mode in the guest. This unsafe handling drives the driver into an unrecoverable state, triggering a kernel PANIC and a guest-wide crash.

Attack Vector

An attacker must already possess local user privileges inside the Windows guest where VMware Tools is installed. From that position, the attacker interacts with the VM3DMP driver through standard user-mode-to-kernel-mode interfaces. The triggering interaction forces the driver into the faulty code path, causing the guest OS to PANIC. Because the attack is local and only affects the guest, it does not escape virtualization boundaries or impact the hypervisor host.

No public proof-of-concept exploit code is currently available for this issue, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the VMware Security Advisory VMSA-2022-0029 for vendor technical details.

Detection Methods for CVE-2022-31693

Indicators of Compromise

• Unexpected Windows guest bug checks (Blue Screen of Death) referencing the vm3dmp.sys driver in the crash dump or MEMORY.DMP analysis.
• System event log entries such as Event ID 1001 (BugCheck) coinciding with user activity from non-administrative accounts.
• Repeated guest VM crashes that recover normally without hypervisor host instability.

Detection Strategies

• Analyze Windows kernel crash dumps with WinDbg and review the faulting module; investigate cases where vm3dmp.sys appears in the call stack.
• Inventory VMware Tools versions across Windows guests and flag any installation below 12.1.5.
• Correlate guest crash events with the user session that was active at crash time to identify potential local triggering.

Monitoring Recommendations

• Forward Windows System and Application event logs from guests to a centralized logging or SIEM platform for crash event correlation.
• Track VMware Tools version drift through configuration management or vulnerability scanning tooling.
• Alert on repeated BugCheck events from the same guest or user context, which may indicate exploitation attempts rather than incidental faults.

How to Mitigate CVE-2022-31693

Immediate Actions Required

• Upgrade VMware Tools for Windows to version 12.1.5 or later on all affected Windows guests.
• Restrict local guest access on sensitive Windows VMs to trusted, authenticated users only.
• Review VMware Tools inventory across the estate and prioritize guests running 10.x.y and 11.x.y, which have no fixed branch and must move to 12.1.5+.

Patch Information

VMware addressed the vulnerability in VMware Tools for Windows 12.1.5. Refer to the VMware Security Advisory VMSA-2022-0029 for official remediation guidance. Downstream advisories for affected ecosystems are available from NetApp Security Advisory NTAP-20221223-0009 and NetApp Security Advisory NTAP-20230824-0009.

Workarounds

• Limit interactive and remote logon rights on Windows guests to reduce local attack surface until patching is complete.
• Where 3D graphics acceleration is not required, disable virtual 3D support on the VM to reduce reliance on the VM3DMP driver.
• Maintain current guest snapshots or backups so that DoS-induced crashes can be recovered quickly during the remediation window.

# Example: check installed VMware Tools version on a Windows guest via PowerShell
Get-ItemProperty 'HKLM:\SOFTWARE\VMware, Inc.\VMware Tools' |
    Select-Object -Property ProductVersion, InstallPath

# Example: query the VM3DMP driver file version
Get-Item 'C:\Windows\System32\drivers\vm3dmp.sys' |
    Select-Object -ExpandProperty VersionInfo