# Cve 2025 41244 Vmware Tools Lpe

> Use this skill whenever analyzing VMware Tools privilege escalation vulnerabilities, CVE-2025-41244, untrusted search path issues, or regex-driven service discovery abuse patterns. Also use when investigating vmtoolsd processes, service discovery scripts, or when you need to detect/mitigate CWE-426 vulnerabilities in monitoring agents. This skill helps security professionals understand, detect, and remediate the untrusted search path vulnerability in VMware Tools service discovery.

- Skill: `abelrguezr/cve-2025-41244-vmware-tools-lpe` (Agent Skill, multi-file: 5 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/cve-2025-41244-vmware-tools-lpe`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/cve-2025-41244-vmware-tools-lpe/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Product & Planning
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/abelrguezr/cve-2025-41244-vmware-tools-lpe

---


# CVE-2025-41244: VMware Tools Service Discovery LPE

A skill for analyzing, detecting, and mitigating the untrusted search path vulnerability (CWE-426) in VMware Tools service discovery that allows local privilege escalation.

## What this vulnerability is

CVE-2025-41244 is a local privilege escalation vulnerability in VMware Tools/open-vm-tools on Linux. The service discovery component uses permissive regex patterns to match running processes and then executes the matched binary with a version flag. When the regex accepts untrusted paths (e.g., `/tmp/httpd`), an attacker can place a malicious binary in a writable location and have it executed with elevated privileges.

**Key characteristics:**
- **Impact**: Local privilege escalation to root (or privileged discovery account)
- **Root cause**: Untrusted Search Path (CWE-426) + permissive regex matching
- **Affected**: open-vm-tools/VMware Tools on Linux, VMware Aria Operations SDMP
- **MITRE ATT&CK**: T1036.005 (Match Legitimate Name or Location)

## When to use this skill

Use this skill when:
- You need to assess if a system is vulnerable to CVE-2025-41244
- You're investigating suspicious vmtoolsd or service discovery activity
- You need to write detection rules for this vulnerability class
- You're hardening VMware Tools installations
- You're analyzing similar regex-driven service discovery patterns in other agents
- You need to understand the exploitation mechanics for defensive purposes

## Vulnerability mechanics

### How the vulnerable code works

The `get-versions.sh` script in open-vm-tools matches process command lines using broad regex patterns and executes the first token without path validation:

```bash
get_version() {
  PATTERN=$1
  VERSION_OPTION=$2
  for p in $space_separated_pids
  do
    COMMAND=$(get_command_line $p | grep -Eo "$PATTERN")
    [ ! -z "$COMMAND" ] && echo VERSIONSTART "$p" "$("${COMMAND%%[[:space:]]*}" $VERSION_OPTION 2>&1)" VERSIONEND
  done
}
```

**Vulnerable patterns** (from the actual script):
```bash
get_version "/\S+/(httpd-prefork|httpd|httpd2-prefork)(\$|\s)" -v
get_version "/usr/(bin|sbin)/apache\S*" -v
get_version "/\S+/mysqld(\$|\s)" -V
get_version "\.?/\S*nginx(\$|\s)" -v
get_version "/\S+/srm/bin/vmware-dr(\$|\s)" --version
get_version "/\S+/dataserver(\$|\s)" -v
```

The `\S` (non-whitespace) pattern accepts any path, including `/tmp/httpd` or `./nginx`.

### Why this is dangerous

1. **No path validation**: Any matching process path is executed
2. **Privileged execution**: The discovery script runs as root or privileged user
3. **World-writable locations**: Attackers can stage binaries in `/tmp`, `./`, etc.
4. **Automatic triggering**: Discovery runs on a schedule (~5 minutes)

## Detection

### Process tree indicators

Look for suspicious children of vmtoolsd or get-versions.sh:

```bash
# Check for non-system paths being executed by discovery scripts
ps -ef --forest | grep -E "(vmtoolsd|get-versions)" | grep -E "(/tmp/|/home/|/var/tmp/|/dev/shm/)"

# Look for suspicious process ancestry
ps -ef --forest | grep -E "(httpd|nginx|mysqld)" | grep -v "/usr/"
```

### File system artifacts

**Credential-based mode (Aria SDMP):**
```bash
# Check for SDMP wrapper scripts
ls -la /tmp/VMware-SDMP-Scripts-*/

# Look for execution of non-system paths in scripts
grep -r "/tmp/" /tmp/VMware-SDMP-Scripts-*/ 2>/dev/null
```

**Credential-less mode:**
```bash
# Check get-versions.sh for vulnerable patterns
grep -E '\\S' /usr/lib/vmware-tools/services/plugins/serviceDiscovery/get-versions.sh
```

### Log-based detection

**Hunting queries:**
- Uncommon children of vmtoolsd: `/tmp/httpd`, `./nginx`, `/tmp/mysqld`
- Execution of non-system absolute paths by discovery scripts
- File creation in `/tmp/` with daemon names (httpd, nginx, mysqld, dataserver)

**Syslog/audit rules:**
```bash
# Alert on vmtoolsd executing from non-system paths
-a always,exit -F arch=b64 -S execve -F a0=/tmp/* -k vmtoolsd-suspicious
-a always,exit -F arch=b64 -S execve -F a0=/var/tmp/* -k vmtoolsd-suspicious
```

## Mitigation

### Immediate actions

1. **Patch**: Apply Broadcom/VMware updates for CVE-2025-41244
2. **Disable credential-less discovery** where feasible
3. **Restrict /tmp permissions**:
   ```bash
   chmod 1777 /tmp  # Ensure sticky bit is set
   # Consider mounting /tmp as noexec
   mount -o remount,noexec /tmp
   ```

### Long-term hardening

1. **Validate trusted paths**: Modify discovery scripts to only execute from allowlisted directories:
   ```bash
   # Safe pattern - strict allowlist
   candidate=$(get_command_line "$pid" | awk '{print $1}')
   case "$candidate" in
     /usr/sbin/nginx|/usr/sbin/httpd|/usr/sbin/apache2|/usr/bin/mysqld)
         "$candidate" -v 2>&1 ;;
     *)
         : # ignore non-allowlisted paths
         ;;
   esac
   ```

2. **Avoid permissive regexes**: Replace `\S` with explicit, anchored paths
3. **Drop privileges**: Run discovery helpers with minimal privileges
4. **Sandbox**: Use seccomp/AppArmor to restrict system calls
5. **File integrity monitoring**: Monitor get-versions.sh and VMware Tools plugins

### Detection policy recommendations

```bash
# Alert when privileged collectors execute from non-system prefixes
# Regex: ^/(tmp|home|var/tmp|dev/shm)/

# Monitor for:
# - vmtoolsd spawning processes from /tmp/
# - get-versions.sh executing non-system paths
# - New executables in /tmp/ with daemon names
```

## Scripts

Use the bundled scripts for automated detection and remediation:

- `scripts/check_vulnerability.sh` - Check if a system is vulnerable
- `scripts/detect_suspicious_execution.sh` - Detect active exploitation
- `scripts/harden_vmtools.sh` - Apply hardening recommendations

Run these scripts with appropriate privileges and review the output carefully.

## Related vulnerabilities

This vulnerability pattern (regex-driven service discovery abuse) may exist in other monitoring agents and discovery tools. Look for:

- Process enumeration with listening sockets
- Regex-based command line matching with `\S` or similar permissive patterns
- Execution of matched paths without validation
- Privileged execution context

## References

- [NVISO – You name it, VMware elevates it (CVE-2025-41244)](https://blog.nviso.eu/2025/09/29/you-name-it-vmware-elevates-it-cve-2025-41244/)
- [Broadcom advisory for CVE-2025-41244](https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36149)
- [open-vm-tools – serviceDiscovery/get-versions.sh](https://github.com/vmware/open-vm-tools/blob/stable-13.0.0/open-vm-tools/services/plugins/serviceDiscovery/get-versions.sh)
- [MITRE ATT&CK T1036.005](https://attack.mitre.org/techniques/T1036/005/)
- [CWE-426: Untrusted Search Path](https://cwe.mitre.org/data/definitions/426.html)