{"vulnerability": "cve-2022-22942", "sightings": [{"uuid": "6eb2b264-2f76-4e56-b0f8-9dabe8e7a692", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-22942", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:45.000000Z"}, {"uuid": "8762b1df-9d69-4e01-ad5e-32f7c220f0bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-22942", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:43.000000Z"}, {"uuid": "11b7cf85-e74d-4f8a-9be3-560773eba906", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-22942", "type": "seen", "source": "MISP/ab0b745f-bbd5-338e-8b92-97dd0c757e9d", "content": "", "creation_timestamp": "2025-08-31T03:00:53.000000Z"}, {"uuid": "6101780c-c7eb-4011-b361-908ce7be37d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-22942", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/vmwgfx_fd_priv_esc.rb", "content": "", "creation_timestamp": "2023-01-31T19:59:14.000000Z"}, {"uuid": "9e243352-d9bd-4d71-b10a-0fe35f6b6551", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-22942", "type": "seen", "source": "https://t.me/arpsyndicate/1936", "content": "#ExploitObserverAlert\n\nCVE-2022-22942\n\nDESCRIPTION: Exploit Observer has 6 entries related to CVE-2022-22942.\n\nFIRST-EPSS: 0.002090000", "creation_timestamp": "2023-12-18T07:13:48.000000Z"}, {"uuid": "ce3cc7c6-f5df-4bfc-b189-48ce5b79b1c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-22942", "type": "seen", "source": "https://t.me/arpsyndicate/2870", "content": "#ExploitObserverAlert\n\nCVE-2022-22942\n\nDESCRIPTION: Exploit Observer has 9 entries in 3 file formats related to CVE-2022-22942. The vmwgfx driver contains a local privilege escalation vulnerability that allows unprivileged users to gain access to files opened by other processes on the system through a dangling 'file' pointer.\n\nFIRST-EPSS: 0.000720000\nNVD-IS: 5.9\nNVD-ES: 1.8", "creation_timestamp": "2024-01-16T18:33:08.000000Z"}, {"uuid": "c2a7397e-735c-4459-b375-a09e5ac9104a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-22942", "type": "seen", "source": "https://t.me/ctinow/165591", "content": "https://ift.tt/r6Ycwlf\nCVE-2022-22942 | Vmware Photon OS 3.0/4.0 vmwgfx Driver use after free", "creation_timestamp": "2024-01-10T08:06:54.000000Z"}, {"uuid": "68e3fb58-7417-4cc9-b053-2407de3c9737", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-22942", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/vmwgfx_fd_priv_esc.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"x86, x64\", \"author\": [\"h00die\", \"Mathias Krause\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"If the vmwgfx driver fails to copy the 'fence_rep' object to userland, it tries to\\n          recover by deallocating the (already populated) file descriptor. This is\\n          wrong, as the fd gets released via put_unused_fd() which shouldn't be used,\\n          as the fd table slot was already populated via the previous call to\\n          fd_install(). This leaves userland with a valid fd table entry pointing to\\n          a free'd 'file' object.\\n\\n          We use this bug to overwrite a SUID binary with our payload and gain root.\\n          Linux kernel 4.14 - 5.16.x are vulnerable.\\n\\n          Successfully tested against Ubuntu 22.04.01 with kernel 5.13.12-051312-generic.\", \"disclosure_date\": \"2022-01-28\", \"fullname\": \"exploit/linux/local/vmwgfx_fd_priv_esc\", \"is_install_path\": true, \"mod_time\": \"2026-06-07 17:50:49 +0000\", \"name\": \"vmwgfx Driver File Descriptor Handling Priv Esc\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-os-down\"]}, \"path\": \"/modules/exploits/linux/local/vmwgfx_fd_priv_esc.rb\", \"platform\": \"Linux\", \"post_auth\": false, \"rank\": 400, \"ref_name\": \"linux/local/vmwgfx_fd_priv_esc\", \"references\": [\"URL-https://grsecurity.net/exploiting_and_defending_against_same_type_object_reuse\", \"URL-https://github.com/opensrcsec/same_type_object_reuse_exploits\", \"CVE-2022-22942\"], \"rport\": null, \"session_types\": [\"shell\", \"meterpreter\"], \"targets\": [\"Auto\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:14.339432Z"}]}