摘要:
open-vm-tools security update
安全等级: High
公告ID: KylinSec-SA-2023-2263
发布日期: 2023年9月15日
关联CVE: CVE-2023-20867 CVE-2023-20900
The project is an open source implementation of VMware Tools. It is a suite of open source virtualization utilities and drivers to improve the functionality, user experience and administration of VMware virtual machines. This package contains only the core user-space programs and libraries of .
Security Fix(es):
A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.(CVE-2023-20867)
A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html .(CVE-2023-20900)
| cve名称 | 产品 | 组件 | 是否受影响 |
|---|---|---|---|
| CVE-2023-20867 | KY3.5.2 | open-vm-tools | Fixed |
| CVE-2023-20900 | KY3.5.2 | open-vm-tools | Fixed |
| 软件名称 | 架构 | 版本号 |
|---|---|---|
| open-vm-tools-test | x86_64 | 12.0.5-4.ky3_5 |
| open-vm-tools-salt-minion | x86_64 | 12.0.5-4.ky3_5 |
| open-vm-tools-devel | x86_64 | 12.0.5-4.ky3_5 |
| open-vm-tools-sdmp | x86_64 | 12.0.5-4.ky3_5 |
| open-vm-tools | x86_64 | 12.0.5-4.ky3_5 |
| open-vm-tools-desktop | x86_64 | 12.0.5-4.ky3_5 |
| open-vm-tools-sdmp | aarch64 | 12.0.5-4.ky3_5 |
| open-vm-tools-desktop | aarch64 | 12.0.5-4.ky3_5 |
| open-vm-tools-test | aarch64 | 12.0.5-4.ky3_5 |
| open-vm-tools-devel | aarch64 | 12.0.5-4.ky3_5 |
| open-vm-tools | aarch64 | 12.0.5-4.ky3_5 |
方法一：下载安装包进行升级安装
1、通过下载链接下载需要升级的升级包保存，如 xxx.rpm
2、通过rpm命令升级，如 rpm -Uvh xxx.rpm
方法二：通过软件源进行升级安装
1、保持能够连接上互联网
2、通过yum命令升级指定的包，如 yum install 包名
