{"uuid": "68e3fb58-7417-4cc9-b053-2407de3c9737", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-22942", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/vmwgfx_fd_priv_esc.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"x86, x64\", \"author\": [\"h00die\", \"Mathias Krause\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"If the vmwgfx driver fails to copy the 'fence_rep' object to userland, it tries to\\n          recover by deallocating the (already populated) file descriptor. This is\\n          wrong, as the fd gets released via put_unused_fd() which shouldn't be used,\\n          as the fd table slot was already populated via the previous call to\\n          fd_install(). This leaves userland with a valid fd table entry pointing to\\n          a free'd 'file' object.\\n\\n          We use this bug to overwrite a SUID binary with our payload and gain root.\\n          Linux kernel 4.14 - 5.16.x are vulnerable.\\n\\n          Successfully tested against Ubuntu 22.04.01 with kernel 5.13.12-051312-generic.\", \"disclosure_date\": \"2022-01-28\", \"fullname\": \"exploit/linux/local/vmwgfx_fd_priv_esc\", \"is_install_path\": true, \"mod_time\": \"2026-06-07 17:50:49 +0000\", \"name\": \"vmwgfx Driver File Descriptor Handling Priv Esc\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-os-down\"]}, \"path\": \"/modules/exploits/linux/local/vmwgfx_fd_priv_esc.rb\", \"platform\": \"Linux\", \"post_auth\": false, \"rank\": 400, \"ref_name\": \"linux/local/vmwgfx_fd_priv_esc\", \"references\": [\"URL-https://grsecurity.net/exploiting_and_defending_against_same_type_object_reuse\", \"URL-https://github.com/opensrcsec/same_type_object_reuse_exploits\", \"CVE-2022-22942\"], \"rport\": null, \"session_types\": [\"shell\", \"meterpreter\"], \"targets\": [\"Auto\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:14.339432Z"}