CVE-2022-22942 Use after free in Photon OS
Unprivileged local users can exploit a dangling pointer in the vmwgfx driver to access files opened by other processes, leading to privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-22942?
CVE-2022-22942 is a high-severity use after free vulnerability in Photon OS, published on 13 Dec 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The vmwgfx driver contains a local privilege escalation vulnerability that allows unprivileged users to gain access to files opened by other processes on the system through a dangling 'file' pointer.
Weakness: CWE-416
Which versions are affected by CVE-2022-22942?
It affects 1 product.
Products include Vmware Photon Os.
How do I fix CVE-2022-22942?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2022-22942 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-22942 exists.
Public exploit code: 1 Metasploit module.
Other vulnerabilities in Photon OS
Sources
Also known as DEBIAN-CVE-2022-22942, GHSA-r3gf-pg53-xqph, UBUNTU-CVE-2022-22942.