VMware fixes Fusion flaw introduced in the attempt to fix CVE-2020

VMware Fusion, VMware Remote Console for Mac, and Horizon Client for Mac contain a local privilege escalation flaw (CWE-269, Improper Privilege Management) caused by improper use of setuid binaries, which run with elevated privileges when executed. An attacker who already has normal (non-root) user access to a Mac where one of these products is installed can invoke the misconfigured setuid binaries to execute code as root. Successful exploitation grants full root-level control over the affected machine, with high impact on confidentiality, integrity, and availability (CVSS 3.1: 7.8). Only macOS installations of Fusion 11.x before 11.5.2, VMRC for Mac 11.x and prior before 11.0.1, and Horizon Client for Mac 5.x and prior before 5.4.0 are affected. Public proof-of-concept exploits are available, and CISA added the CVE to the Known Exploited Vulnerabilities catalog on 2021-11-03, confirming exploitation in the wild; whether ransomware operators use it is unknown.

Do: Upgrade affected Macs to VMware Fusion 11.5.2 or later, VMRC for Mac 11.0.1 or later, and Horizon Client for Mac 5.4.0 or later, per VMware's instructions. Because exploitation requires local user access, prioritize multi-user Macs and machines where untrusted users can execute code; inventory managed Macs for these products and verify installed versions. As the CVE is on the CISA KEV catalog, apply the vendor updates as the required action.

VMware Fusion (11.x before 11.5.5), VMware Remote Console for Mac (11.x and prior) and VMware Horizon Client for Mac (5.x and prior) contain a local privilege escalation vulnerability due to a Time-of-check Time-of-use (TOCTOU) issue in the service opener. Successful exploitation of this issue may allow attackers with normal user privileges to escalate their privileges to root on the system where Fusion, VMRC and Horizon Client are installed.