CVE-2025-41244

What is VMware Aria Operations and VMware Tools SDMP?

VMware Aria Operations (formerly vRealize Operations) is an IT operations management platform that monitors, analyzes, and optimizes VMware vSphere environments. Its Service Discovery Management Pack (SDMP) component automatically discovers and inventories services running inside virtual machines by periodically running discovery scripts on the guest OS.

VMware Tools is the software package installed inside every VMware guest VM to enable management functions, performance monitoring, and guest-host communication.

When Aria Operations' SDMP is enabled and manages VMs with VMware Tools installed, the SDMP discovery scripts run inside guest VMs with root-level privileges — creating a privilege escalation surface exploitable from within any managed guest VM.

Overview

CVE-2025-41244 is a privilege-defined-with-unsafe-actions vulnerability (CWE-267) in VMware Tools when managed by Aria Operations with SDMP enabled. The SDMP's get_versions.sh script uses a regex pattern that inadvertently matches binaries in user-writable directories (e.g., /tmp/httpd). A local low-privilege attacker places a malicious binary at a matched path; when SDMP's discovery cron runs, it executes the binary with root privileges. NVISO Labs discovered forensic evidence that UNC5174, a Chinese state-sponsored APT, exploited this as a zero-day for approximately one year before the patch was released.

Affected Versions

Prerequisite: SDMP must be enabled and managing VMs with VMware Tools installed.

Technical Details

The vulnerable get_versions.sh script in the Aria Operations SDMP uses regex patterns to find system service binaries for version inventory. The pattern /\S+/(httpd-prefork|httpd|httpd2-prefork) — matching "any non-whitespace path" followed by the binary name — inadvertently matches binaries in user-writable directories like /tmp, /var/tmp, or $HOME.

A low-privilege attacker places a malicious binary named httpd (or another matched name) at /tmp/httpd. When the SDMP discovery cron runs (approximately every 5 minutes), it finds and executes /tmp/httpd with root privileges, granting the attacker full root access to the guest VM.

Key characteristics:

• Only requires local VM access (any unprivileged account)
• SDMP runs automatically on a cron schedule — no attacker interaction needed after binary placement
• Exploitable from inside any guest VM managed by Aria Operations with SDMP enabled
• Attack complexity is Low (AC:L) — finding and writing to /tmp is trivial

Discovery

NVISO Labs — Maxime Thiebaut — identified forensic indicators during a customer incident response in May 2025. Forensic timeline reconstruction estimated UNC5174 had been exploiting the vulnerability since approximately October 2024 — nearly 12 months as a zero-day.

Exploitation Context

UNC5174 (also tracked as Earth Freybug by Trend Micro), a Chinese state-sponsored APT with nexus to Ministry of State Security (MSS) contractor activities, exploited this vulnerability in targeted attacks against enterprise VMware environments. The approximately 11-month zero-day window allowed significant undetected access. CISA added the vulnerability to the KEV catalog on October 30, 2025.

Remediation

1. Apply patches: Aria Operations 8.18.5+, VMware Tools 12.5.4+ or 13.0.5+, Cloud Foundation 9.0.1.0+. Upgrade EOL VMware Tools 11.x to a supported version.
2. Disable SDMP if service discovery functionality is not operationally required — this eliminates the attack surface entirely.
3. Hunt for suspicious binaries in /tmp, /var/tmp, and user home directories on all managed VMs named httpd, httpd2-prefork, httpd-prefork, and other service binary names matched by SDMP patterns.
4. Review SDMP discovery logs for unexpected binary execution events across managed guest VMs.
5. Assume compromise on VMware environments that were exposed to the internet and managed with SDMP since October 2024 — UNC5174 had a 12-month window.
6. Rotate all credentials stored on or accessible from managed VMs, particularly any that could be used for lateral movement within the VMware environment.