CVE-2021-21999: 
VMware App Volumes Manager vulnerability analysis and mitigation

CVE-2021-21999 is a local privilege escalation vulnerability discovered in VMware Tools for Windows, VMware Remote Console for Windows (VMRC), and VMware App Volumes. The vulnerability was disclosed on June 22, 2021, affecting VMware Tools versions 11.x.y prior to 11.2.6, VMRC for Windows 12.x prior to 12.0.1, and App Volumes versions 2.x prior to 2.18.10 and 4 prior to 2103. The vulnerability was reported by Zeeshan Shaikh from NotSoSecure working with Trend Micro Zero Day Initiative and Hou JingYi of Qihoo 360 (VMware Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (High) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The specific flaw exists within the VGAuthService service and results from the lack of proper validation of a user-supplied OpenSSL configuration file prior to using it. The issue is classified as an Uncontrolled Search Path Element vulnerability (CWE-427) (ZDI Advisory, NVD).

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code with elevated privileges in the context of SYSTEM. This could lead to complete system compromise, allowing the attacker to gain full control over the affected system (ZDI Advisory).

The vulnerability requires an attacker to have normal access to a virtual machine for successful exploitation. The attack vector involves placing a malicious file renamed as 'openssl.cnf' in an unrestricted directory, which would then allow code to be executed with elevated privileges (VMware Advisory, SecurityWeek).

VMware has released patches to address this vulnerability. Users are advised to update to VMware Tools for Windows version 11.2.6, VMRC for Windows version 12.0.1, App Volumes 4 version 2103, or App Volumes 2.18.10. No workarounds are available for this vulnerability, making patching the only effective mitigation strategy (VMware Advisory).