CVE-2023-34059

2023-10-2600:00:00

ubuntu.com

open-vm-tools

file descriptor hijack

vulnerability

cve-2023-34059

vmware-user-suid-wrapper

non-root privileges

/dev/uinput

simulate user inputs

6.1 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

5.2%

JSON

open-vm-tools contains a file descriptor hijack vulnerability in the
vmware-user-suid-wrapper. A malicious actor with non-root privileges may be
able to hijack the /dev/uinput file descriptor allowing them to simulate
user inputs.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchopen-vm-tools< 2:11.0.5-4ubuntu0.18.04.3+esm3UNKNOWN
ubuntu20.04noarchopen-vm-tools< 2:11.3.0-2ubuntu0~ubuntu20.04.7UNKNOWN
ubuntu22.04noarchopen-vm-tools< 2:12.1.5-3~ubuntu0.22.04.4UNKNOWN
ubuntu23.04noarchopen-vm-tools< 2:12.1.5-3ubuntu0.23.04.3UNKNOWN
ubuntu23.10noarchopen-vm-tools< 2:12.3.0-1ubuntu0.1UNKNOWN
ubuntu14.04noarchopen-vm-tools< anyUNKNOWN
ubuntu16.04noarchopen-vm-tools< 2:10.2.0-3~ubuntu0.16.04.1+esm4UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	open-vm-tools	< 2:11.0.5-4ubuntu0.18.04.3+esm3	UNKNOWN
ubuntu	20.04	noarch	open-vm-tools	< 2:11.3.0-2ubuntu0~ubuntu20.04.7	UNKNOWN
ubuntu	22.04	noarch	open-vm-tools	< 2:12.1.5-3~ubuntu0.22.04.4	UNKNOWN
ubuntu	23.04	noarch	open-vm-tools	< 2:12.1.5-3ubuntu0.23.04.3	UNKNOWN
ubuntu	23.10	noarch	open-vm-tools	< 2:12.3.0-1ubuntu0.1	UNKNOWN
ubuntu	14.04	noarch	open-vm-tools	< any	UNKNOWN
ubuntu	16.04	noarch	open-vm-tools	< 2:10.2.0-3~ubuntu0.16.04.1+esm4	UNKNOWN