Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Fri, 27 Oct 2023 03:43:46 +0000
From: VMware Security Response Center <>
To: "" <>
Subject: CVE-2023-34059 - File Descriptor Hijack vulnerability in



CVE-2023-34059: open-vm-tools contains a file descriptor hijack vulnerability in the vmware-user-suid-wrapper. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.4. - CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Known Attack Vectors


A malicious actor with non-root privileges may be able to hijack the /dev/uinput file descriptor allowing them to simulate user inputs.



VMware would like to thank Matthias Gerstner of the SUSE Linux Security Team for reporting this vulnerability to us.



The following patch is provided for all open-vm-tools releases 11.0.0 through 12.3.0

The patches have been tested against the above open-vm-tools releases.  Each applies cleanly with:

git am for a git repository.

patch -p2 in the top directory of an open-vm-tools source tree.


Edward Hawkins

Staff-2 Technical Program Manager<>

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.