--- id: CVE-2023-20900 title: "A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html \_in a target virtual machine may be able to elevate their p…" summary: "A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html \_in a target virtual machine may be able to elevate their p…" severity: high cvss: 7.1 cvssVector: 'CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H' cwe: - CWE-294 - CWE-347 vendor: vmware product: tools affected: - 'tools >= 10.3.0, < 12.3.0' - 'tools >= 10.3.0, < 10.3.26' - 'open_vm_tools >= 10.3.0, < 12.3.0' - fedora = 37 - fedora = 38 - fedora = 39 - debian_linux = 10.0 - debian_linux = 11.0 - debian_linux = 12.0 - ontap_select_deploy_administration_utility patched: - tools 10.3.26 - open_vm_tools 12.3.0 published: '2023-08-31' updated: '2026-10-08' sourceUpdated: '2026-10-08T22:17:22.590' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2023-20900' references: - url: 'http://www.openwall.com/lists/oss-security/2023/08/31/1' label: security@vmware.com - url: 'http://www.openwall.com/lists/oss-security/2023/10/27/1' label: security@vmware.com - url: 'https://lists.debian.org/debian-lts-announce/2023/10/msg00000.html' label: security@vmware.com - url: >- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NVKQ6Y2JFJRWPFOZUOTFO3H27BK5GGOG/ label: security@vmware.com - url: >- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TJNJMD67QIT6LXLKWSHFM47DCLRSMT6W/ label: security@vmware.com - url: >- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZJM6HDRQYS74JA7YNKQBFH2XSZ52HEWH/ label: security@vmware.com - url: 'https://security.netapp.com/advisory/ntap-20231013-0002/' label: security@vmware.com - url: 'https://www.debian.org/security/2023/dsa-5493' label: security@vmware.com - url: 'https://www.vmware.com/security/advisories/VMSA-2023-0019.html' label: security@vmware.com - url: 'http://www.openwall.com/lists/oss-security/2023/08/31/1' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.openwall.com/lists/oss-security/2023/10/27/1' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2023/10/msg00000.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NVKQ6Y2JFJRWPFOZUOTFO3H27BK5GGOG/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TJNJMD67QIT6LXLKWSHFM47DCLRSMT6W/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZJM6HDRQYS74JA7YNKQBFH2XSZ52HEWH/ label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.netapp.com/advisory/ntap-20231013-0002/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.debian.org/security/2023/dsa-5493' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.vmware.com/security/advisories/VMSA-2023-0019.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-20900.json - url: 'https://access.redhat.com/security/cve/CVE-2023-20900' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2236542' - url: 'https://www.cve.org/CVERecord?id=CVE-2023-20900' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2023-20900' - url: >- https://github.com/vmware/open-vm-tools/blob/CVE-2023-20900.patch/CVE-2023-20900.patch - url: 'https://access.redhat.com/errata/RHSA-2023:5217' - url: 'https://access.redhat.com/errata/RHSA-2024:5315' - url: 'https://access.redhat.com/errata/RHSA-2023:5213' - url: 'https://access.redhat.com/errata/RHSA-2023:5210' - url: 'https://access.redhat.com/errata/RHSA-2023:5216' - url: 'https://access.redhat.com/errata/RHSA-2023:5220' - url: 'https://access.redhat.com/errata/RHSA-2023:5312' - url: 'https://access.redhat.com/errata/RHSA-2023:5218' - url: 'https://access.redhat.com/errata/RHSA-2023:5313' tags: - nvd - csaf - vex - red-hat - cve.org epss: 0.01475 epssPercentile: 0.73691 ingestedAt: '2026-10-08T23:16:47.351Z' ssvc: exploitation: none automatable: 'no' technicalImpact: total timestamp: '2026-10-08T21:06:58.363980Z' --- ## Overview A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html  in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html . ## Affected - `tools >= 10.3.0, < 12.3.0` - `tools >= 10.3.0, < 10.3.26` - `open_vm_tools >= 10.3.0, < 12.3.0` - `fedora = 37` - `fedora = 38` - `fedora = 39` - `debian_linux = 10.0` - `debian_linux = 11.0` - `debian_linux = 12.0` - `ontap_select_deploy_administration_utility` ## Remediation Upgrade past the affected range: - `tools 10.3.26` - `open_vm_tools 12.3.0` ## Vendor advisories - **RHSA-2023:5217** · Red Hat · fixed in: Red Hat Enterprise Linux Client (v. 7), Red Hat Enterprise Linux Client Optional (v. 7), Red Hat Enterprise Linux ComputeNode Optional (v. 7), Red Hat Enterprise Linux Server (v. 7), Red Hat Enterprise Linux Server Optional (v. 7), Red Hat Enterprise Linux Workstation (v. 7), … · released 2023-09-19 · [advisory](https://access.redhat.com/errata/RHSA-2023:5217) - **RHSA-2024:5315** · Red Hat · fixed in: Red Hat Enterprise Linux Server AUS (v. 7.7), Red Hat Enterprise Linux Server Optional AUS (v. 7.7) · released 2024-08-13 · [advisory](https://access.redhat.com/errata/RHSA-2024:5315) - **RHSA-2023:5213** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v. 8.1) · released 2023-09-19 · [advisory](https://access.redhat.com/errata/RHSA-2023:5213) - **RHSA-2023:5210** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v. 8.2), Red Hat Enterprise Linux AppStream E4S (v. 8.2), Red Hat Enterprise Linux AppStream TUS (v. 8.2) · released 2023-09-19 · [advisory](https://access.redhat.com/errata/RHSA-2023:5210) - **RHSA-2023:5216** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream E4S (v.8.4), Red Hat Enterprise Linux AppStream TUS (v.8.4) · released 2023-09-19 · [advisory](https://access.redhat.com/errata/RHSA-2023:5216) - **RHSA-2023:5220** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.8.6) · released 2023-09-19 · [advisory](https://access.redhat.com/errata/RHSA-2023:5220) - **RHSA-2023:5312** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2023-09-20 · [advisory](https://access.redhat.com/errata/RHSA-2023:5312) - **RHSA-2023:5218** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.0) · released 2023-09-19 · [advisory](https://access.redhat.com/errata/RHSA-2023:5218) - **RHSA-2023:5313** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2023-09-20 · [advisory](https://access.redhat.com/errata/RHSA-2023:5313)