Privilege Escalation Vulnerability (CVE‑2025‑41244) in Broadcom VMware Aria Operations & Tools Allows Local VM User to Gain Root
What It Is – Broadcom’s VMware Aria Operations and VMware Tools contain a privilege‑defined‑with‑unsafe‑actions flaw. A malicious actor with a non‑administrative account on a virtual machine that has VMware Tools installed and is managed by Aria Operations (SDMP enabled) can exploit the defect to elevate to root on that VM.
Exploitability – The vulnerability is local‑only; no public exploit code is known, but the attack path is straightforward for any attacker with VM‑level access. CVSS v3.1 scores 7.8 (High).
Affected Products – Broadcom VMware Aria Operations (any version with SDMP) and VMware Tools (all supported versions).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous verification that privileged actions are tightly scoped and that “privilege‑defined‑with‑unsafe‑actions” patterns are eliminated – a core Access Control objective.
- Provides audit evidence that your environment enforces least‑privilege policies on VM‑level agents, supporting defensible compliance reporting (e.g., NIST CSF 2.0 PR.AC‑1).
- Highlights the importance of continuous monitoring of configuration drift in hyper‑visors and guest agents to prove due‑diligence to auditors and enterprise buyers.
Recommended Actions
- Review and harden the privilege definitions for VMware Tools and Aria Operations; disable SDMP if not required.
- Apply Broadcom’s patch (or upgrade to the latest patched release) as soon as it is available.
- Validate that only authorized, least‑privileged accounts can execute actions inside VMs; capture configuration evidence for audit.
- Incorporate the control into your continuous monitoring pipeline to detect any re‑introduction of unsafe privilege definitions.
Source: CISA KEV – CVE‑2025‑41244