Import from CS git

.open-vm-tools.metadata

@@ -0,0 +1 @@
+84ec127c620c46f6cddb5e38ce556a31244a967d SOURCES/open-vm-tools-12.3.5-22544099.tar.gz

SOURCES/ovt-SDMP-Service-Discovery-Plugin.patch

@@ -0,0 +1,133 @@
+From 68384f6ab79233817b5bf3370f0a46ee20a7f7e8 Mon Sep 17 00:00:00 2001
+From: Vitaly Kuznetsov <vkuznets@redhat.com>
+Date: Wed, 1 Oct 2025 10:49:34 +0200
+Subject: [PATCH] SDMP: Service Discovery Plugin
+
+RH-Author: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-MergeRequest: 56: SDMP: Service Discovery Plugin
+RH-Jira: RHEL-117388
+RH-Acked-by: roverflow <None>
+RH-Acked-by: Maxim Levitsky <None>
+RH-Acked-by: Ani Sinha <anisinha@redhat.com>
+RH-Commit: [1/1] b8e63c398b7615bbbd86ae3b4539717e4fff74b1
+
+JIRA: https://issues.redhat.com/browse/RHEL-117388
+CVE: CVE-2025-41244
+
+commit 7ed196cf01f8acd09011815a605b6733894b8aab
+Author: Kruti Pendharkar <kp025370@broadcom.com>
+Date:   Mon Sep 29 01:02:40 2025 -0700
+
+    Address CVE-2025-41244
+     - Disable (default) the execution of the SDMP get-versions.sh script.
+
+    With the Linux SDMP get-versions.sh script disabled, version information
+    of installed services will not be made available to VMware Aria
+
+RHEL-only: used
+https://github.com/vmware/open-vm-tools/blob/CVE-2025-41244.patch/CVE-2025-41244-1230-1235-SDMP.patch
+patch for 12.3 version.
+
+Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+---
+ .../serviceDiscovery/serviceDiscovery.c       | 34 ++++++++++++++++---
+ 1 file changed, 30 insertions(+), 4 deletions(-)
+
+diff --git a/open-vm-tools/services/plugins/serviceDiscovery/serviceDiscovery.c b/open-vm-tools/services/plugins/serviceDiscovery/serviceDiscovery.c
+index 103cf14e..2f65294b 100644
+--- a/open-vm-tools/services/plugins/serviceDiscovery/serviceDiscovery.c
++++ b/open-vm-tools/services/plugins/serviceDiscovery/serviceDiscovery.c
+@@ -115,6 +115,12 @@ static gchar* scriptInstallDir = NULL;
+  */
+ #define SERVICE_DISCOVERY_RPC_WAIT_TIME 100
+ 
++/*
++ * Defines the configuration to enable/disable version obtaining logic
++ */
++#define CONFNAME_SERVICEDISCOVERY_VERSION_CHECK "version-check-enabled"
++#define SERVICE_DISCOVERY_CONF_DEFAULT_VERSION_CHECK FALSE
++
+ /*
+  * Defines the configuration to cache data in gdp plugin
+  */
+@@ -1239,23 +1245,27 @@ ServiceDiscoveryServerShutdown(gpointer src,
+  *
+  * Construct final paths of the scripts that will be used for execution.
+  *
++ * @param[in] versionCheckEnabled  TRUE to include the SERVICE_DISCOVERY_KEY_VERSIONS
++ *                                 entry; FALSE to skip it (derived from config).
++ *
+  *****************************************************************************
+  */
+ 
+ static void
+-ConstructScriptPaths(void)
++ConstructScriptPaths(Bool versionCheckEnabled)
+ {
+    int i;
+ #if !defined(OPEN_VM_TOOLS)
+    gchar *toolsInstallDir;
+ #endif
++   int insertIndex = 0;
+ 
+    if (gFullPaths != NULL) {
+       return;
+    }
+ 
+    gFullPaths = g_array_sized_new(FALSE, TRUE, sizeof(KeyNameValue),
+-                                  ARRAYSIZE(gKeyScripts));
++                                  ARRAYSIZE(gKeyScripts) - (versionCheckEnabled ? 0u : 1u));
+    if (scriptInstallDir == NULL) {
+ #if defined(OPEN_VM_TOOLS)
+       scriptInstallDir = Util_SafeStrdup(VMTOOLS_SERVICE_DISCOVERY_SCRIPTS);
+@@ -1267,6 +1277,15 @@ ConstructScriptPaths(void)
+ #endif
+    }
+    for (i = 0; i < ARRAYSIZE(gKeyScripts); ++i) {
++      /*
++       * Skip adding if:
++       * 1. Version check is disabled, AND
++       * 2. The keyName matches SERVICE_DISCOVERY_KEY_VERSIONS
++       */
++      if (!versionCheckEnabled &&
++         g_strcmp0(gKeyScripts[i].keyName, SERVICE_DISCOVERY_KEY_VERSIONS) == 0) {
++         continue;
++      }
+       KeyNameValue tmp;
+       tmp.keyName = g_strdup_printf("%s", gKeyScripts[i].keyName);
+ #if defined(_WIN32)
+@@ -1274,7 +1293,8 @@ ConstructScriptPaths(void)
+ #else
+       tmp.val = g_strdup_printf("%s%s%s", scriptInstallDir, DIRSEPS, gKeyScripts[i].val);
+ #endif
+-      g_array_insert_val(gFullPaths, i, tmp);
++      g_array_insert_val(gFullPaths, insertIndex, tmp);
++      insertIndex++;
+    }
+ }
+ 
+@@ -1340,14 +1360,20 @@ ToolsOnLoad(ToolsAppCtx *ctx)
+          }
+       };
+       gboolean disabled;
++      Bool versionCheckEnabled;
+ 
+       regData.regs = VMTools_WrapArray(regs,
+                                        sizeof *regs,
+                                        ARRAYSIZE(regs));
++      versionCheckEnabled = VMTools_ConfigGetBoolean(
++         ctx->config,
++         CONFGROUPNAME_SERVICEDISCOVERY,
++         CONFNAME_SERVICEDISCOVERY_VERSION_CHECK,
++         SERVICE_DISCOVERY_CONF_DEFAULT_VERSION_CHECK);
+       /*
+        * Append scripts execution command line
+        */
+-      ConstructScriptPaths();
++      ConstructScriptPaths(versionCheckEnabled);
+ 
+       disabled =
+          VMTools_ConfigGetBoolean(ctx->config,
+-- 
+2.47.3
+

SOURCES/ovt-Validate-user-names-and-file-paths.patch

@@ -1,8 +1,15 @@
-From 7874e572b5aac5a418551dc5e3935c1e74bf6f1f Mon Sep 17 00:00:00 2001
+From 4440325c484b0090722c5e2d69ea0e0f2e8c2824 Mon Sep 17 00:00:00 2001
 From: John Wolfe <john.wolfe@broadcom.com>
 Date: Mon, 5 May 2025 15:58:03 -0700
 Subject: [PATCH] Validate user names and file paths
 
+RH-Author: boyang <None>
+RH-MergeRequest: 67: Validate user names and file paths
+RH-Jira: RHEL-129361
+RH-Acked-by: Lili Du <None>
+RH-Acked-by: Ani Sinha <anisinha@redhat.com>
+RH-Commit: [1/1] 6ea0f82d1db1fd2e8f5515dbe4fb57c258fb4458
+
 Prevent usage of illegal characters in user names and file paths.
 Also, disallow unexpected symlinks in file paths.
 
@@ -18,6 +25,9 @@ be updated to:
 The 2025 Broadcom copyright information update is not part of this
 patch set to allow the patch to be easily applied to previous
 open-vm-tools source releases.
+
+Cherry picked from commit 7874e572b5aac5a418551dc5e3935c1e74bf6f1f
+Signed-off-by: boyang <boyang@redhat.com>
 ---
  open-vm-tools/vgauth/common/VGAuthUtil.c      | 33 +++++++++
  open-vm-tools/vgauth/common/VGAuthUtil.h      |  2 +
@@ -29,7 +39,7 @@ open-vm-tools source releases.
  7 files changed, 160 insertions(+), 3 deletions(-)
 
 diff --git a/open-vm-tools/vgauth/common/VGAuthUtil.c b/open-vm-tools/vgauth/common/VGAuthUtil.c
-index 76383c462..9c2adb8d0 100644
+index 76383c46..9c2adb8d 100644
 --- a/open-vm-tools/vgauth/common/VGAuthUtil.c
 +++ b/open-vm-tools/vgauth/common/VGAuthUtil.c
 @@ -309,3 +309,36 @@ Util_Assert(const char *cond,
@@ -70,24 +80,24 @@ index 76383c462..9c2adb8d0 100644
 +   return ret;
 +}
 diff --git a/open-vm-tools/vgauth/common/VGAuthUtil.h b/open-vm-tools/vgauth/common/VGAuthUtil.h
-index f7f3aa216..ef32a91da 100644
+index f7f3aa21..ef32a91d 100644
 --- a/open-vm-tools/vgauth/common/VGAuthUtil.h
 +++ b/open-vm-tools/vgauth/common/VGAuthUtil.h
 @@ -105,4 +105,6 @@ gboolean Util_CheckExpiration(const GTimeVal *start, unsigned int duration);
-
+ 
  void Util_Assert(const char *cond, const char *file, int lineNum);
-
+ 
 +int Util_Utf8CaseCmp(const gchar *str1, const gchar *str2);
 +
  #endif
 diff --git a/open-vm-tools/vgauth/common/prefs.h b/open-vm-tools/vgauth/common/prefs.h
-index 6c58f3f4b..3299eb26c 100644
+index 6c58f3f4..3299eb26 100644
 --- a/open-vm-tools/vgauth/common/prefs.h
 +++ b/open-vm-tools/vgauth/common/prefs.h
 @@ -167,6 +167,9 @@ msgCatalog = /etc/vmware-tools/vgauth/messages
  /** Where the localized version of the messages were installed. */
  #define VGAUTH_PREF_LOCALIZATION_DIR        "msgCatalog"
-
+ 
 +/** If symlinks or junctions are allowed in alias store file path */
 +#define VGAUTH_PREF_ALLOW_SYMLINKS  "allowSymlinks"
 +
@@ -95,13 +105,13 @@ index 6c58f3f4b..3299eb26c 100644
   * Pref values
   */
 diff --git a/open-vm-tools/vgauth/common/usercheck.c b/open-vm-tools/vgauth/common/usercheck.c
-index 3beede2e8..340aa0411 100644
+index 3beede2e..340aa041 100644
 --- a/open-vm-tools/vgauth/common/usercheck.c
 +++ b/open-vm-tools/vgauth/common/usercheck.c
 @@ -78,6 +78,8 @@
   * Solaris as well, but that path is untested.
   */
-
+ 
 +#define MAX_USER_NAME_LEN 256
 +
  /*
@@ -119,7 +129,7 @@ index 3beede2e8..340aa0411 100644
 +    * should not contain path traversal characters ('/' and '\').
 +    */
 +   char *illegalChars = "<>/\\";
-
+ 
     len = strlen(userName);
 -   if (strcspn(userName, illegalChars) != len) {
 +   if (len > MAX_USER_NAME_LEN) {
@@ -138,9 +148,9 @@ index 3beede2e8..340aa0411 100644
 +
     return TRUE;
  }
-
+ 
 diff --git a/open-vm-tools/vgauth/serviceImpl/alias.c b/open-vm-tools/vgauth/serviceImpl/alias.c
-index 4e170202c..c7040ebff 100644
+index 4e170202..c7040ebf 100644
 --- a/open-vm-tools/vgauth/serviceImpl/alias.c
 +++ b/open-vm-tools/vgauth/serviceImpl/alias.c
 @@ -41,6 +41,7 @@
@@ -148,28 +158,28 @@ index 4e170202c..c7040ebff 100644
  #include "VGAuthProto.h"
  #include "vmxlog.h"
 +#include "VGAuthUtil.h"
-
+ 
  // puts the identity store in an easy to find place
  #undef WIN_TEST_MODE
 @@ -66,6 +67,7 @@
  #define ALIASSTORE_FILE_PREFIX   "user-"
  #define ALIASSTORE_FILE_SUFFIX   ".xml"
-
+ 
 +static gboolean allowSymlinks = FALSE;
  static gchar *aliasStoreRootDir = DEFAULT_ALIASSTORE_ROOT_DIR;
-
+ 
  #ifdef _WIN32
 @@ -252,6 +254,12 @@ mapping file layout:
-
+ 
   */
-
+ 
 +#ifdef _WIN32
 +#define ISPATHSEP(c)  ((c) == '\\' || (c) == '/')
 +#else
 +#define ISPATHSEP(c)  ((c) == '/')
 +#endif
 +
-
+ 
  /*
   ******************************************************************************
 @@ -466,6 +474,7 @@ ServiceLoadFileContentsWin(const gchar *fileName,
@@ -177,13 +187,13 @@ index 4e170202c..c7040ebff 100644
     BOOL ok;
     DWORD bytesRead;
 +   gchar *realPath = NULL;
-
+ 
     *fileSize = 0;
     *contents = NULL;
 @@ -622,6 +631,22 @@ ServiceLoadFileContentsWin(const gchar *fileName,
        goto done;
     }
-
+ 
 +   if (!allowSymlinks) {
 +      /*
 +       * Check if fileName is real path.
@@ -208,7 +218,7 @@ index 4e170202c..c7040ebff 100644
     }
     g_free(fileNameW);
 +   g_free(realPath);
-
+ 
     return err;
  }
 @@ -672,6 +698,7 @@ ServiceLoadFileContentsPosix(const gchar *fileName,
@@ -216,13 +226,13 @@ index 4e170202c..c7040ebff 100644
     gchar *bp;
     int fd = -1;
 +   gchar realPath[PATH_MAX] = { 0 };
-
+ 
     *fileSize = 0;
     *contents = NULL;
 @@ -817,6 +844,23 @@ ServiceLoadFileContentsPosix(const gchar *fileName,
        goto done;
     }
-
+ 
 +   if (!allowSymlinks) {
 +      /*
 +       * Check if fileName is real path.
@@ -244,7 +254,7 @@ index 4e170202c..c7040ebff 100644
      * All confidence checks passed; read the bits.
      */
 @@ -2803,8 +2847,13 @@ ServiceAliasRemoveAlias(const gchar *reqUserName,
-
+ 
     /*
      * We don't verify the user exists in a Remove operation, to allow
 -    * cleanup of deleted user's stores.
@@ -255,13 +265,13 @@ index 4e170202c..c7040ebff 100644
 +      Warning("%s: Illegal user name '%s'\n", __FUNCTION__, userName);
 +      return VGAUTH_E_FAIL;
 +   }
-
+ 
     if (!CertVerify_IsWellFormedPEMCert(pemCert)) {
        return VGAUTH_E_INVALID_CERTIFICATE;
 @@ -3036,6 +3085,16 @@ ServiceAliasQueryAliases(const gchar *userName,
     }
  #endif
-
+ 
 +   /*
 +    * We don't verify the user exists in a Query operation to allow
 +    * cleaning up after a deleted user, but we do check whether the
@@ -280,13 +290,13 @@ index 4e170202c..c7040ebff 100644
     gboolean saveBadDir = FALSE;
     char *defaultDir = NULL;
 +   size_t len;
-
+ 
  #ifdef _WIN32
     {
 @@ -3324,6 +3384,10 @@ ServiceAliasInitAliasStore(void)
     defaultDir = g_strdup(DEFAULT_ALIASSTORE_ROOT_DIR);
  #endif
-
+ 
 +   allowSymlinks = Pref_GetBool(gPrefs,
 +                                VGAUTH_PREF_ALLOW_SYMLINKS,
 +                                VGAUTH_PREF_GROUP_NAME_SERVICE,
@@ -297,7 +307,7 @@ index 4e170202c..c7040ebff 100644
 @@ -3337,6 +3401,14 @@ ServiceAliasInitAliasStore(void)
                                        VGAUTH_PREF_GROUP_NAME_SERVICE,
                                        defaultDir);
-
+ 
 +   /*
 +    * Remove the trailing separator if any from aliasStoreRootDir path.
 +    */
@@ -307,10 +317,10 @@ index 4e170202c..c7040ebff 100644
 +   }
 +
     Log("Using '%s' for alias store root directory\n", aliasStoreRootDir);
-
+ 
     g_free(defaultDir);
 diff --git a/open-vm-tools/vgauth/serviceImpl/service.c b/open-vm-tools/vgauth/serviceImpl/service.c
-index d4716526c..e053ed0fa 100644
+index d4716526..e053ed0f 100644
 --- a/open-vm-tools/vgauth/serviceImpl/service.c
 +++ b/open-vm-tools/vgauth/serviceImpl/service.c
 @@ -28,6 +28,7 @@
@@ -319,7 +329,7 @@ index d4716526c..e053ed0fa 100644
  #include "winUtil.h"
 +#include <glib.h>
  #endif
-
+ 
  static ServiceStartListeningForIOFunc startListeningIOFunc = NULL;
 @@ -283,9 +284,35 @@ static gchar *
  ServiceUserNameToPipeName(const char *userName)
@@ -354,11 +364,11 @@ index d4716526c..e053ed0fa 100644
                                       SERVICE_PUBLIC_PIPE_NAME,
                                       escapedName);
 +#endif
-
+ 
     g_free(escapedName);
     return pipeName;
 diff --git a/open-vm-tools/vgauth/serviceImpl/serviceInt.h b/open-vm-tools/vgauth/serviceImpl/serviceInt.h
-index 5f420192b..f4f88547d 100644
+index 5f420192..f4f88547 100644
 --- a/open-vm-tools/vgauth/serviceImpl/serviceInt.h
 +++ b/open-vm-tools/vgauth/serviceImpl/serviceInt.h
 @@ -441,6 +441,7 @@ VGAuthError ServiceFileVerifyAdminGroupOwnedByHandle(const HANDLE hFile);
@@ -369,6 +379,6 @@ index 5f420192b..f4f88547d 100644
  #else
  VGAuthError ServiceFileVerifyFileOwnerAndPerms(const char *fileName,
                                                 const char *userName,
---
-2.43.5
+-- 
+2.47.3
 

SPECS/open-vm-tools.spec

@@ -32,7 +32,7 @@
 
 Name:             open-vm-tools
 Version:          %{toolsversion}
-Release:          2%{?dist}.alma.1
+Release:          2%{?dist}.2
 Summary:          Open Virtual Machine Tools for virtual machines hosted on VMware
 License:          GPLv2
 URL:              https://github.com/vmware/%{name}
@@ -52,8 +52,10 @@ ExclusiveArch:    %{ix86} x86_64 aarch64
 %endif
 
 # Patch0: name.patch
-# https://github.com/vmware/open-vm-tools/tree/CVE-2025-22247.patch
-Patch0: 0000-open-vm-tools-cve-2025-22247.patch
+# For RHEL-117388 - [CISA Major Incident] CVE-2025-41244 open-vm-tools: Local privilege escalation in open-vm-tools [rhel-8.10.z]
+Patch1: ovt-SDMP-Service-Discovery-Plugin.patch
+# For RHEL-129361 - Backport of CVE-2025-22247 to 8.10
+Patch2: ovt-Validate-user-names-and-file-paths.patch
 
 BuildRequires:    autoconf
 BuildRequires:    automake
@@ -412,8 +414,15 @@ fi
 %{_bindir}/vmware-vgauth-smoketest
 
 %changelog
-* Thu Jun 12 2025 Jonathan Wright <jonathan@almalinux.org> - 12.3.5-2.alma.1
-- Fix CVE-2025-22247, VMSA-2025-0007
+* Tue Jan 06 2026 Miroslav Rezanina <mrezanin@redhat.com> - 12.3.5-2.el8_10.2
+- ovt-Validate-user-names-and-file-paths.patch [RHEL-129361]
+- Resolves: RHEL-129361
+  (Backport of CVE-2025-22247 to 8.10)
+
+* Tue Oct 07 2025 Miroslav Rezanina <mrezanin@redhat.com> - 12.3.5-2.el8.1
+- ovt-SDMP-Service-Discovery-Plugin.patch [RHEL-117388]
+- Resolves: RHEL-117388
+  ([CISA Major Incident] CVE-2025-41244 open-vm-tools: Local privilege escalation in open-vm-tools [rhel-8.10.z])
 
 * Wed Dec 06 2023 Miroslav Rezanina <mrezanin@redhat.com> - 12.3.5-2
 - ovt-Restart-tools-on-failure.patch [RHEL-17683]