CVE-2022-22942

What it actually does

The vulnerability is a use-after-free in the vmwgfx driver where a dangling file pointer allows unprivileged users to access files opened by other processes, enabling local privilege escalation.

Why it matters to the business

Attackers with local access can gain elevated privileges on affected systems, potentially leading to full system compromise and data theft.

How an attack unfolds

An attacker with local unprivileged access triggers the use-after-free condition in the vmwgfx driver to manipulate a dangling file pointer and read or write files belonging to higher-privileged processes.

How to fix it

Update the vmwgfx driver or kernel to a patched version that resolves the use-after-free issue. Apply the latest security updates for VMware Photon OS as no specific fixed versions are listed.

How to confirm the fix worked

Verify the kernel version and check for patches addressing the dangling file pointer in vmwgfx. Monitor for updates in the Linux kernel changelog.

Typical attack path

1. Obtain local unprivileged access to the system
2. Trigger the race or condition to create dangling file pointer in vmwgfx
3. Use the pointer to access files from other processes
4. Escalate privileges to root

How to detect it

Look for unusual file access patterns in system logs or kernel logs indicating use of vmwgfx driver. Check for processes exploiting graphics driver vulnerabilities.

What your security team should do

• Apply kernel updates immediately
• Restrict local access where possible
• Monitor for privilege escalation attempts in kernel logs