From a0a83e1ae0c77442182d34dc60448034a29eb527 Mon Sep 17 00:00:00 2001 From: eabdullin Date: Wed, 8 Oct 2025 06:54:11 +0000 Subject: [PATCH] import OL open-vm-tools-12.5.0-1.0.1.el9_6.2 --- ...in-vmware-udev-rule-for-scsi-devices.patch | 25 ++++ ...dd-vmware-udev-rule-for-scsi-devices.patch | 31 ++++ ...ix-vmware-udev-rule-for-scsi-devices.patch | 27 ++++ SOURCES/ovt-Address-CVE-2025-41244.patch | 137 ++++++++++++++++++ SPECS/open-vm-tools.spec | 19 ++- 5 files changed, 238 insertions(+), 1 deletion(-) create mode 100644 SOURCES/1003-fix-spaces-in-vmware-udev-rule-for-scsi-devices.patch create mode 100644 SOURCES/add-vmware-udev-rule-for-scsi-devices.patch create mode 100644 SOURCES/fix-vmware-udev-rule-for-scsi-devices.patch create mode 100644 SOURCES/ovt-Address-CVE-2025-41244.patch diff --git a/SOURCES/1003-fix-spaces-in-vmware-udev-rule-for-scsi-devices.patch b/SOURCES/1003-fix-spaces-in-vmware-udev-rule-for-scsi-devices.patch new file mode 100644 index 0000000..40bd903 --- /dev/null +++ b/SOURCES/1003-fix-spaces-in-vmware-udev-rule-for-scsi-devices.patch @@ -0,0 +1,25 @@ +From c1bd2508943a462acdde8dd0914a36e9fd5b50c6 Mon Sep 17 00:00:00 2001 +From: Ashish Samant +Date: Mon, 15 Aug 2016 15:59:23 -0400 +Subject: [PATCH] fix spaces in vmware udev rule for scsi devices + +Orabug: 24461968 + +Signed-off-by: Ashish Samant + +patch forward ported to ol9 +Signed-off-by: Darren Archibald +--- + 99-vmware-scsi-timeout.rules | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a//open-vm-tools-11.0.0-1454943499-vmware-scsi-timeout.rules b/open-vm-tools-11.0.0-14549434/99-vmware-scsi-timeout.rules +index 598d57a..e3729c0 100644 +--- a/open-vm-tools-11.0.0-14549434/99-vmware-scsi-timeout.rules ++++ b/open-vm-tools-11.0.0-14549434/99-vmware-scsi-timeout.rules +@@ -1 +1 @@ +-ACTION=="add", SUBSYSTEMS=="scsi", ATTRS{vendor}=="VMware ", ATTRS{model}=="Virtual disk ", RUN+="/bin/sh -c 'echo 180 > /sys$DEVPATH/timeout'" ++ACTION=="add", SUBSYSTEMS=="scsi", ATTRS{vendor}=="VMware ", ATTRS{model}=="Virtual disk ", RUN+="/bin/sh -c 'echo 180 > /sys$DEVPATH/timeout'" +-- +1.8.3.1 + diff --git a/SOURCES/add-vmware-udev-rule-for-scsi-devices.patch b/SOURCES/add-vmware-udev-rule-for-scsi-devices.patch new file mode 100644 index 0000000..5839e41 --- /dev/null +++ b/SOURCES/add-vmware-udev-rule-for-scsi-devices.patch @@ -0,0 +1,31 @@ +From ce9da81c7fef3b30f458d191542c8e1029ada361 Mon Sep 17 00:00:00 2001 +From: Ashish Samant +Date: Fri, 16 Oct 2015 17:02:29 -0700 +Subject: [PATCH] add-vmware-udev-rule-for-scsi-devices + +Increase timeout for scsi devices on VMWare guests. + +Orabug: 21819156 + +Signed-off-by : Ashish Samant +Reviewed-by : Todd Vierling + +patch forward ported to ol9 +Signed-off-by: Darren Archibald +--- + 99-vmware-scsi-timeout.rules | 3 +++ + 1 file changed, 3 insertions(+) + create mode 100644 99-vmware-scsi-timeout.rules + +diff --git a/open-vm-tools-11.0.0-14549434/99-vmware-scsi-timeout.rules b/open-vm-tools-11.0.0-14549434/99-vmware-scsi-timeout.rules +new file mode 100644 +index 0000000..1f12d0b +--- /dev/null ++++ b/open-vm-tools-11.0.0-14549434/99-vmware-scsi-timeout.rules +@@ -0,0 +1,3 @@ ++ACTION=="add", SUBSYSTEMS=="scsi", ATTRS{vendor}=="VMware ", ++ATTRS{model}=="Virtual disk ", RUN+="/bin/sh -c 'echo 180 ++>/sys$DEVPATH/timeout'" +-- +1.8.3.2 + diff --git a/SOURCES/fix-vmware-udev-rule-for-scsi-devices.patch b/SOURCES/fix-vmware-udev-rule-for-scsi-devices.patch new file mode 100644 index 0000000..5ba9c78 --- /dev/null +++ b/SOURCES/fix-vmware-udev-rule-for-scsi-devices.patch @@ -0,0 +1,27 @@ +From 629c5112b52bfe8f157879cfd1290d351e624e8e Mon Sep 17 00:00:00 2001 +From: Ashish Samant +Date: Wed, 24 Feb 2016 11:45:50 -0500 +Subject: [PATCH] fix-vmware-udev-rule-for-scsi-devices + +Orabug: 22815019 + +Signed-off-by: Ashish Samant + +patch forward ported to ol9 +Signed-off-by: Darren Archibald +--- + 99-vmware-scsi-timeout.rules | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/open-vm-tools-11.0.0-14549434/99-vmware-scsi-timeout.rules b/open-vm-tools-11.0.0-14549434/99-vmware-scsi-timeout.rules +index 1f12d0b..598d57a 100644 +--- a/open-vm-tools-11.0.0-14549434/99-vmware-scsi-timeout.rules ++++ b/open-vm-tools-11.0.0-14549434/99-vmware-scsi-timeout.rules +@@ -1,3 +1 @@ +-ACTION=="add", SUBSYSTEMS=="scsi", ATTRS{vendor}=="VMware ", +-ATTRS{model}=="Virtual disk ", RUN+="/bin/sh -c 'echo 180 +->/sys$DEVPATH/timeout'" ++ACTION=="add", SUBSYSTEMS=="scsi", ATTRS{vendor}=="VMware ", ATTRS{model}=="Virtual disk ", RUN+="/bin/sh -c 'echo 180 > /sys$DEVPATH/timeout'" +-- +1.8.3.1 + diff --git a/SOURCES/ovt-Address-CVE-2025-41244.patch b/SOURCES/ovt-Address-CVE-2025-41244.patch new file mode 100644 index 0000000..5c6e696 --- /dev/null +++ b/SOURCES/ovt-Address-CVE-2025-41244.patch @@ -0,0 +1,137 @@ +From 9b630e7b77cb9c7b2bbd9dc69c98c4f9f9afbe12 Mon Sep 17 00:00:00 2001 +From: Vitaly Kuznetsov +Date: Wed, 1 Oct 2025 13:33:46 +0200 +Subject: [PATCH] Address CVE-2025-41244 + +RH-Author: Vitaly Kuznetsov +RH-MergeRequest: 59: Address CVE-2025-41244 +RH-Jira: RHEL-117390 +RH-Acked-by: roverflow +RH-Acked-by: Maxim Levitsky +RH-Acked-by: Ani Sinha +RH-Commit: [1/1] 0379935def0c0159e1a72a10309052bcb75d2cdd + +JIRA: https://issues.redhat.com/browse/RHEL-117390 +CVE: CVE-2025-41244 + +commit 7ed196cf01f8acd09011815a605b6733894b8aab +Author: Kruti Pendharkar +Date: Mon Sep 29 01:02:40 2025 -0700 + + Address CVE-2025-41244 + - Disable (default) the execution of the SDMP get-versions.sh script. + + With the Linux SDMP get-versions.sh script disabled, version information + of installed services will not be made available to VMware Aria + +Signed-off-by: Vitaly Kuznetsov +--- + .../serviceDiscovery/serviceDiscovery.c | 37 ++++++++++++++++--- + 1 file changed, 32 insertions(+), 5 deletions(-) + +diff --git a/open-vm-tools/services/plugins/serviceDiscovery/serviceDiscovery.c b/open-vm-tools/services/plugins/serviceDiscovery/serviceDiscovery.c +index e35f1c00..bf4edd5c 100644 +--- a/open-vm-tools/services/plugins/serviceDiscovery/serviceDiscovery.c ++++ b/open-vm-tools/services/plugins/serviceDiscovery/serviceDiscovery.c +@@ -1,5 +1,6 @@ + /********************************************************* +- * Copyright (c) 2020-2021,2023 VMware, Inc. All rights reserved. ++ * Copyright (c) 2020-2025 Broadcom. All Rights Reserved. ++ * The term "Broadcom" refers to Broadcom Inc. and/or its subsidiaries. + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU Lesser General Public License as published +@@ -121,6 +122,12 @@ static gchar* scriptInstallDir = NULL; + #define CONFNAME_SERVICEDISCOVERY_CACHEDATA "cache-data" + #define SERVICE_DISCOVERY_CONF_DEFAULT_CACHEDATA TRUE + ++/* ++ * Defines the configuration to enable/disable version obtaining logic ++ */ ++#define CONFNAME_SERVICEDISCOVERY_VERSION_CHECK "version-check-enabled" ++#define SERVICE_DISCOVERY_CONF_DEFAULT_VERSION_CHECK FALSE ++ + /* + * Define the configuration to require at least one subscriber subscribed for + * the gdp message. +@@ -1260,23 +1267,27 @@ ServiceDiscoveryServerShutdown(gpointer src, + * + * Construct final paths of the scripts that will be used for execution. + * ++ * @param[in] versionCheckEnabled TRUE to include the SERVICE_DISCOVERY_KEY_VERSIONS ++ * entry; FALSE to skip it (derived from config). ++ * + ***************************************************************************** + */ + + static void +-ConstructScriptPaths(void) ++ConstructScriptPaths(Bool versionCheckEnabled) + { + int i; + #if !defined(OPEN_VM_TOOLS) + gchar *toolsInstallDir; + #endif ++ int insertIndex = 0; + + if (gFullPaths != NULL) { + return; + } + + gFullPaths = g_array_sized_new(FALSE, TRUE, sizeof(KeyNameValue), +- ARRAYSIZE(gKeyScripts)); ++ ARRAYSIZE(gKeyScripts) - (versionCheckEnabled ? 0u : 1u)); + if (scriptInstallDir == NULL) { + #if defined(OPEN_VM_TOOLS) + scriptInstallDir = Util_SafeStrdup(VMTOOLS_SERVICE_DISCOVERY_SCRIPTS); +@@ -1288,6 +1299,15 @@ ConstructScriptPaths(void) + #endif + } + for (i = 0; i < ARRAYSIZE(gKeyScripts); ++i) { ++ /* ++ * Skip adding if: ++ * 1. Version check is disabled, AND ++ * 2. The keyName matches SERVICE_DISCOVERY_KEY_VERSIONS ++ */ ++ if (!versionCheckEnabled && ++ g_strcmp0(gKeyScripts[i].keyName, SERVICE_DISCOVERY_KEY_VERSIONS) == 0) { ++ continue; ++ } + KeyNameValue tmp; + tmp.keyName = g_strdup_printf("%s", gKeyScripts[i].keyName); + #if defined(_WIN32) +@@ -1295,7 +1315,8 @@ ConstructScriptPaths(void) + #else + tmp.val = g_strdup_printf("%s%s%s", scriptInstallDir, DIRSEPS, gKeyScripts[i].val); + #endif +- g_array_insert_val(gFullPaths, i, tmp); ++ g_array_insert_val(gFullPaths, insertIndex, tmp); ++ insertIndex++; + } + } + +@@ -1361,14 +1382,20 @@ ToolsOnLoad(ToolsAppCtx *ctx) + } + }; + gboolean disabled; ++ Bool versionCheckEnabled; + + regData.regs = VMTools_WrapArray(regs, + sizeof *regs, + ARRAYSIZE(regs)); ++ versionCheckEnabled = VMTools_ConfigGetBoolean( ++ ctx->config, ++ CONFGROUPNAME_SERVICEDISCOVERY, ++ CONFNAME_SERVICEDISCOVERY_VERSION_CHECK, ++ SERVICE_DISCOVERY_CONF_DEFAULT_VERSION_CHECK); + /* + * Append scripts execution command line + */ +- ConstructScriptPaths(); ++ ConstructScriptPaths(versionCheckEnabled); + + disabled = + VMTools_ConfigGetBoolean(ctx->config, +-- +2.47.3 + diff --git a/SPECS/open-vm-tools.spec b/SPECS/open-vm-tools.spec index 168d869..4856b51 100644 --- a/SPECS/open-vm-tools.spec +++ b/SPECS/open-vm-tools.spec @@ -31,7 +31,7 @@ Name: open-vm-tools Version: %{toolsversion} -Release: 1%{?dist} +Release: 1.0.1%{?dist}.2 Summary: Open Virtual Machine Tools for virtual machines hosted on VMware License: GPLv2 URL: https://github.com/vmware/%{name} @@ -43,6 +43,11 @@ Source3: run-vmblock\x2dfuse.mount Source4: open-vm-tools.conf Source5: vmtoolsd.pam +# Oracle patches +Patch1001: add-vmware-udev-rule-for-scsi-devices.patch +Patch1002: fix-vmware-udev-rule-for-scsi-devices.patch +Patch1003: 1003-fix-spaces-in-vmware-udev-rule-for-scsi-devices.patch + %if 0%{?rhel} >= 7 ExclusiveArch: x86_64 aarch64 %else @@ -51,6 +56,8 @@ ExclusiveArch: %{ix86} x86_64 aarch64 # Patches #Patch0: .patch +# For RHEL-117390 - [CISA Major Incident] CVE-2025-41244 open-vm-tools: Local privilege escalation in open-vm-tools [rhel-9.6.z] +Patch1: ovt-Address-CVE-2025-41244.patch BuildRequires: autoconf BuildRequires: automake @@ -420,6 +427,16 @@ fi %{_bindir}/vmware-vgauth-smoketest %changelog +* Tue Oct 07 2025 EL Errata - 12.5.0-1.0.1.2 +- Fix spaces in vmware udev rule for scsi devices [Orabug: 24461968] +- Fix vmware udev rule in 99-vmware-scsi-timeout.rules file. [Orabug: 22815019] +- Increase timeout for scsi devices on VMWare guests by adding a udev rule. [Orabug: 21819156] + +* Mon Oct 06 2025 Miroslav Rezanina - 12.5.0-1.el9_6.2 +- ovt-Address-CVE-2025-41244.patch [RHEL-117390] +- Resolves: RHEL-117390 + ([CISA Major Incident] CVE-2025-41244 open-vm-tools: Local privilege escalation in open-vm-tools [rhel-9.6.z]) + * Tue Dec 03 2024 Miroslav Rezanina - 12.5.0-1 - Rebase to 12.5.0 [RHEL-63096] - Resolves: RHEL-63096