Re: CVE-2025-22247 - Insecure file handling vulnerability in open-vm-tools

[Solar Designer <solar () openwall com>]

Hi,

Thank you very much VMware PSIRT for fixing and disclosing this issue.

I'm sorry I'm not familiar with open-vm-tools, but I thought we could
clarify the below for everyone in here:

On Mon, May 12, 2025 at 06:57:46PM +0530, VMware PSIRT wrote:
> A malicious actor with non-administrative privileges on a guest VM may
> tamper the local files to trigger insecure file operations within that VM.

> https://github.com/vmware/open-vm-tools/tree/CVE-2025-22247.patch

The commit message says:

> Prevent usage of illegal characters in user names and file paths.
> Also, disallow unexpected symlinks in file paths.

Skimming the code changes, I see that the second part - "disallow
unexpected symlinks in file paths" - is implemented by calling
realpath() (or a Windows function on that platform) and seeing whether
that changed the pathname or (almost) not.  However, this will not
disallow a symlink that appears after the realpath() call but before
subsequent use of the pathname.

Is a race condition like this relevant, or is it irrelevant given the
way these tools are normally used?  In other words, is the filesystem
static when this code runs, or is it a live VM where "a malicious actor
with non-administrative privileges" may operate concurrently with this
code running?

Can you please clarify?

Thanks again,

Alexander