Analysis of VMware Fusion Local Privilege Escalation Vulnerability

VMware released a security update for their Apple OS X specific virtualization software called Fusion. It has been reported to Alpha Team researchers the original patch for this issue failed to address the issue. After extensive analysis, Alpha Team has concluded that this vulnerability does not pose a significant threat to OS X security.

Vulnerability Details

A mixture of unique conditions in OS X and Fusion allow a local user to escalate their privileges to root. The vulnerability requires the attacker to already have a local account on the victim system. The vulnerability relies on OS X allowing users to create hard symbolic links to setuid binaries.

Recommendations

Apply patches. VMware has released a patch that addresses this issue that is described here. Follow best practices for hardening your OS X. Limit physical access to Apple hardware to reduce attack surface.

Analyst Insight

Although this vulnerability is not particularly groundbreaking, Alpha Team chose to review because according to OSINT sources, the original VMware patch does not actually fix the flaw. Patches that don’t fix the issue are worthing exploring because of the insights they offer into the software development cycle of the vendor.

Alpha Team assesses with high confidence that this vulnerability alone does not pose a significant risk to OS X integrity. This exploit could be included in OS X attack chains, but it will have to be used with other vulnerabilities.

Technical Analysis

The vulnerability was reported to VMware by Grimm, a cybersecurity-focused consulting company. When the original patch was released by VMware, Grimm released a detailed blog about discovery and exploitation of these flaws. The blog can be found here. Grimm’s blog links to a GitHub repository that contains sample code to take advantage of the vulnerabilities.

The issue is caused by incorection permissions being set on tools that Fusion requires to run. These permissions allow a normal user to elevate to root. We duplicated the steps detailed in the blog on a machine with the VMware patches installed.

The first step was determining if the Fusion binaries still had the same permissions set. A quick search using the command line utility find will show the answer.

Next is just running the exploit script. There are two scripts: one for Fusion core services and one specifically for the USB proxy tool. Testing has shown that the scripts have the same functionality and are equally reliable.

After running these scripts, we have a root shell on a patched version of VMware Fusion.

Research and Exploitation

This exploit alone does not pose a significant risk to OS X security due to the privilege level required for successful exploitation. Alpha Team has observed no occurrences of this exploit or vulnerability exploitation in the wild.