[rpms/open-vm-tools] rawhide: * Mon Oct 06 2025 Miroslav Rezanina <mrezanin@redhat.com> - 13.0.0-2

[rpms/open-vm-tools] rawhide: * Mon Oct 06 2025 Miroslav Rezanina <mrezanin@redhat.com> - 13.0.0-2

[Miroslav Rezanina]

            A new commit has been pushed.

            Repo   : rpms/open-vm-tools
            Branch : rawhide
            Commit : 81173af145543538aead57759a4f2546a37ae8b7
            Author : Miroslav Rezanina <mrezanin@redhat.com>
            Date   : 2025-10-06T10:22:11+02:00
            Stats  : +223/-1 in 3 file(s)
            URL    : https://src.fedoraproject.org/rpms/open-vm-tools/c/81173af145543538aead57759a4f2546a37ae8b7?branch=rawhide

            Log:
            * Mon Oct 06 2025 Miroslav Rezanina <mrezanin@redhat.com> - 13.0.0-2

- ovt-Handle-new-cloud-init-error-code-and-status.patch [RHEL-99781]
- ovt-Address-CVE-2025-41244.patch [RHEL-117382]
- Resolves: RHEL-99781
  (Cloud-init receives TERM signal from PID 1 in the middle of running user data [rhel-10])
- Resolves: RHEL-117382
  ([CISA Major Incident] CVE-2025-41244 open-vm-tools: Local privilege escalation in open-vm-tools [rhel-10.2])

---
diff --git a/open-vm-tools.spec b/open-vm-tools.spec
index a5d0d36..265c275 100644
--- a/open-vm-tools.spec
+++ b/open-vm-tools.spec
@@ -31,7 +31,7 @@
 
 Name:             open-vm-tools
 Version:          %{toolsversion}
-Release:          1%{?dist}
+Release:          2%{?dist}
 Summary:          Open Virtual Machine Tools for virtual machines hosted on VMware
 %if 0%{?bundle_gtkmm3}
 # atkmm: LGPL-2.1-or-later
@@ -78,6 +78,10 @@ ExclusiveArch:    %{ix86} x86_64 aarch64
 
 # Patches
 #Patch0:           <patch-name0>.patch
+# For RHEL-99781 - Cloud-init receives TERM signal from PID 1 in the middle of running user data [rhel-10]
+Patch1: ovt-Handle-new-cloud-init-error-code-and-status.patch
+# For RHEL-117382 - [CISA Major Incident] CVE-2025-41244 open-vm-tools: Local privilege escalation in open-vm-tools [rhel-10.2]
+Patch2: ovt-Address-CVE-2025-41244.patch
 # Fix build when compiling with -std=c23 (GCC 15)
 #Patch1:           https://github.com/vmware/open-vm-tools/pull/751.patch
 
@@ -624,6 +628,14 @@ fi
 %{_bindir}/vmware-vgauth-smoketest
 
 %changelog
+* Mon Oct 06 2025 Miroslav Rezanina <mrezanin@redhat.com> - 13.0.0-2
+- ovt-Handle-new-cloud-init-error-code-and-status.patch [RHEL-99781]
+- ovt-Address-CVE-2025-41244.patch [RHEL-117382]
+- Resolves: RHEL-99781
+  (Cloud-init receives TERM signal from PID 1 in the middle of running user data [rhel-10])
+- Resolves: RHEL-117382
+  ([CISA Major Incident] CVE-2025-41244 open-vm-tools: Local privilege escalation in open-vm-tools [rhel-10.2])
+
 * Thu Jul 24 2025 Bo Yang <boyang@redhat.com> - 13.0.0-1
 - Rebase to 13.0.0 [RHEL-99156]
 - Resolves: RHEL-99156

diff --git a/ovt-Address-CVE-2025-41244.patch b/ovt-Address-CVE-2025-41244.patch
new file mode 100644
index 0000000..c0b6c77
--- /dev/null
+++ b/ovt-Address-CVE-2025-41244.patch
@@ -0,0 +1,136 @@
+From f5f0a81af7f6b2681818a4b679e701c6624f148e Mon Sep 17 00:00:00 2001
+From: Vitaly Kuznetsov <vkuznets@redhat.com>
+Date: Wed, 1 Oct 2025 10:00:09 +0200
+Subject: [PATCH 2/2] Address CVE-2025-41244
+
+RH-Author: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-MergeRequest: 13: Address CVE-2025-41244
+RH-Jira: RHEL-117382
+RH-Acked-by: roverflow <None>
+RH-Acked-by: Maxim Levitsky <None>
+RH-Acked-by: Ani Sinha <anisinha@redhat.com>
+RH-Commit: [1/1] 24479069095a468673d67a3f332fc69337abf400 (vkuznets/open-vm-tools)
+
+JIRA: https://issues.redhat.com/browse/RHEL-117382
+CVE: CVE-2025-41244
+
+commit 3ab0685c1cf7981c84898d546a73d6db6dcd3823
+Author: Kruti Pendharkar <kp025370@broadcom.com>
+Date:   Mon Sep 29 23:03:43 2025 -0700
+
+    Address CVE-2025-41244
+     - Disable (default) the execution of the SDMP get-versions.sh script.
+
+    With the Linux SDMP get-versions.sh script disabled, version information
+    of installed services will not be made available to VMware Aria
+
+Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+---
+ .../serviceDiscovery/serviceDiscovery.c       | 36 ++++++++++++++++---
+ 1 file changed, 31 insertions(+), 5 deletions(-)
+
+diff --git a/open-vm-tools/services/plugins/serviceDiscovery/serviceDiscovery.c b/open-vm-tools/services/plugins/serviceDiscovery/serviceDiscovery.c
+index 0da598f1..5e9772e9 100644
+--- a/open-vm-tools/services/plugins/serviceDiscovery/serviceDiscovery.c
++++ b/open-vm-tools/services/plugins/serviceDiscovery/serviceDiscovery.c
+@@ -1,5 +1,5 @@
+ /*********************************************************
+- * Copyright (c) 2020-2024 Broadcom. All Rights Reserved.
++ * Copyright (c) 2020-2025 Broadcom. All Rights Reserved.
+  * The term "Broadcom" refers to Broadcom Inc. and/or its subsidiaries.
+  *
+  * This program is free software; you can redistribute it and/or modify it
+@@ -122,6 +122,12 @@ static gchar* scriptInstallDir = NULL;
+ #define CONFNAME_SERVICEDISCOVERY_CACHEDATA "cache-data"
+ #define SERVICE_DISCOVERY_CONF_DEFAULT_CACHEDATA TRUE
+ 
++/*
++ * Defines the configuration to enable/disable version obtaining logic
++ */
++#define CONFNAME_SERVICEDISCOVERY_VERSION_CHECK "version-check-enabled"
++#define SERVICE_DISCOVERY_CONF_DEFAULT_VERSION_CHECK FALSE
++
+ /*
+  * Define the configuration to require at least one subscriber subscribed for
+  * the gdp message.
+@@ -1265,23 +1271,27 @@ ServiceDiscoveryServerShutdown(gpointer src,
+  *
+  * Construct final paths of the scripts that will be used for execution.
+  *
++ * @param[in] versionCheckEnabled  TRUE to include the SERVICE_DISCOVERY_KEY_VERSIONS
++ *                                 entry; FALSE to skip it (derived from config).
++ *
+  *****************************************************************************
+  */
+ 
+ static void
+-ConstructScriptPaths(void)
++ConstructScriptPaths(Bool versionCheckEnabled)
+ {
+    int i;
+ #if !defined(OPEN_VM_TOOLS)
+    gchar *toolsInstallDir;
+ #endif
++   int insertIndex = 0;
+ 
+    if (gFullPaths != NULL) {
+       return;
+    }
+ 
+    gFullPaths = g_array_sized_new(FALSE, TRUE, sizeof(KeyNameValue),
+-                                  ARRAYSIZE(gKeyScripts));
++                                  ARRAYSIZE(gKeyScripts) - (versionCheckEnabled ? 0u : 1u));
+    if (scriptInstallDir == NULL) {
+ #if defined(OPEN_VM_TOOLS)
+       scriptInstallDir = Util_SafeStrdup(VMTOOLS_SERVICE_DISCOVERY_SCRIPTS);
+@@ -1293,6 +1303,15 @@ ConstructScriptPaths(void)
+ #endif
+    }
+    for (i = 0; i < ARRAYSIZE(gKeyScripts); ++i) {
++      /*
++       * Skip adding if:
++       * 1. Version check is disabled, AND
++       * 2. The keyName matches SERVICE_DISCOVERY_KEY_VERSIONS
++       */
++      if (!versionCheckEnabled &&
++         g_strcmp0(gKeyScripts[i].keyName, SERVICE_DISCOVERY_KEY_VERSIONS) == 0) {
++         continue;
++      }
+       KeyNameValue tmp;
+       tmp.keyName = g_strdup_printf("%s", gKeyScripts[i].keyName);
+ #if defined(_WIN32)
+@@ -1300,7 +1319,8 @@ ConstructScriptPaths(void)
+ #else
+       tmp.val = g_strdup_printf("%s%s%s", scriptInstallDir, DIRSEPS, gKeyScripts[i].val);
+ #endif
+-      g_array_insert_val(gFullPaths, i, tmp);
++      g_array_insert_val(gFullPaths, insertIndex, tmp);
++      insertIndex++;
+    }
+ }
+ 
+@@ -1366,14 +1386,20 @@ ToolsOnLoad(ToolsAppCtx *ctx)
+          }
+       };
+       gboolean disabled;
++      Bool versionCheckEnabled;
+ 
+       regData.regs = VMTools_WrapArray(regs,
+                                        sizeof *regs,
+                                        ARRAYSIZE(regs));
++      versionCheckEnabled = VMTools_ConfigGetBoolean(
++         ctx->config,
++         CONFGROUPNAME_SERVICEDISCOVERY,
++         CONFNAME_SERVICEDISCOVERY_VERSION_CHECK,
++         SERVICE_DISCOVERY_CONF_DEFAULT_VERSION_CHECK);
+       /*
+        * Append scripts execution command line
+        */
+-      ConstructScriptPaths();
++      ConstructScriptPaths(versionCheckEnabled);
+ 
+       disabled =
+          VMTools_ConfigGetBoolean(ctx->config,
+-- 
+2.47.3
+

diff --git a/ovt-Handle-new-cloud-init-error-code-and-status.patch b/ovt-Handle-new-cloud-init-error-code-and-status.patch
new file mode 100644
index 0000000..5473c0b
--- /dev/null
+++ b/ovt-Handle-new-cloud-init-error-code-and-status.patch
@@ -0,0 +1,74 @@
+From 6c4130754b183c929b5092bab516c6391974ddcb Mon Sep 17 00:00:00 2001
+From: Pengpeng Sun <pengpeng.sun@broadcom.com>
+Date: Wed, 27 Aug 2025 14:19:58 +0800
+Subject: [PATCH 1/2] Handle new cloud-init error code and status
+
+RH-Author: Ani Sinha <anisinha@redhat.com>
+RH-MergeRequest: 12: Handle new cloud-init error code and status
+RH-Jira: RHEL-99781
+RH-Acked-by: xiachen <xiachen@redhat.com>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Commit: [1/1] 40a705507363b9e508fcc50250d51c8eca7e81a3 (anisinha/centos-open-vm-tools)
+
+ - A new error code [1] was introduced in cloud-init v23.4, RedHat team reported
+that our OVT code shall handle this new error code properly, see
+https://github.com/vmware/open-vm-tools/issues/768.
+This change follows the backwards-compatible way in
+https://cloudinit.readthedocs.io/en/latest/explanation/return_codes.html
+to check that the return code is not equal to 1.
+
+ - Running status has been changed from "not run" to "not started" in
+cloud-init v24.1, see details in
+https://github.com/canonical/cloud-init/commit/d175170aedc1398b85ac767573b8773a5a2e7c6f.
+This change adds "not started" match to CLOUDINIT_STATUS_NOT_RUN.
+
+This patch was sent by John Wolfe over email and has been pushed upstream here:
+https://github.com/vmware/open-vm-tools/blob/Handle-new-cloud-init-error-code.patch/
+
+Addresses open-vm-tools issue https://github.com/vmware/open-vm-tools/issues/768
+
+This change has been tested internally by Amy Chen and is seen to fix the
+original issue.
+
+1. https://cloudinit.readthedocs.io/en/latest/explanation/failure_states.html#error-codes
+
+Signed-off-by: Ani Sinha <anisinha@redhat.com>
+---
+ open-vm-tools/libDeployPkg/linuxDeployment.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/open-vm-tools/libDeployPkg/linuxDeployment.c b/open-vm-tools/libDeployPkg/linuxDeployment.c
+index 44cac8ef..82e83957 100644
+--- a/open-vm-tools/libDeployPkg/linuxDeployment.c
++++ b/open-vm-tools/libDeployPkg/linuxDeployment.c
+@@ -1313,6 +1313,7 @@ static CLOUDINIT_STATUS_CODE
+ GetCloudinitStatus() {
+    // Cloud-init execution status messages
+    static const char* NOT_RUN = "not run";
++   static const char* NOT_STARTED = "not started";
+    static const char* RUNNING = "running";
+    static const char* DONE = "done";
+    static const char* ERROR = "error";
+@@ -1326,13 +1327,16 @@ GetCloudinitStatus() {
+                                            false,
+                                            cloudinitStatusCmdOutput,
+                                            MAX_LENGTH_CLOUDINIT_STATUS);
+-   if (forkExecResult != 0) {
+-      sLog(log_info, "Unable to get cloud-init status.");
+-      return CLOUDINIT_STATUS_UNKNOWN;
++   if (forkExecResult == 1) {
++      sLog(log_info, "Cloud-init experienced unrecoverable error.");
++      return CLOUDINIT_STATUS_ERROR;
+    } else {
+       if (strstr(cloudinitStatusCmdOutput, NOT_RUN) != NULL) {
+          sLog(log_info, "Cloud-init status is '%s'.", NOT_RUN);
+          return CLOUDINIT_STATUS_NOT_RUN;
++      } else if (strstr(cloudinitStatusCmdOutput, NOT_STARTED) != NULL) {
++         sLog(log_info, "Cloud-init status is '%s'.", NOT_STARTED);
++         return CLOUDINIT_STATUS_NOT_RUN;
+       } else if (strstr(cloudinitStatusCmdOutput, RUNNING) != NULL) {
+          sLog(log_info, "Cloud-init status is '%s'.", RUNNING);
+          return CLOUDINIT_STATUS_RUNNING;
+-- 
+2.47.3
+