CVE-2017-4915

HIGH

VMware Workstation Pro/Player - Privilege Escalation

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 3 public exploits for CVE-2017-4915. PoCs published by Google Security Research, bcoles, Jann Horn, bcoles, including Metasploit module exploits/linux/local/vmware_alsa_config.

AI-analyzed exploit summary This exploit leverages VMWare Workstation's loading of libasound in a setuid context, allowing an unprivileged user to gain root privileges by injecting a malicious shared library via ~/.asoundrc. The library executes a constructor function that escalates privileges when loaded by the vmware-vmx process.

Description

VMware Workstation Pro/Player contains an insecure library loading vulnerability via ALSA sound driver configuration files. Successful exploitation of this issue may allow unprivileged host users to escalate their privileges to root in a Linux host machine.

Exploits (3)

exploitdb WORKING POC VERIFIED
by Google Security Research · clocallinux
https://www.exploit-db.com/exploits/42045

This exploit leverages VMWare Workstation's loading of libasound in a setuid context, allowing an unprivileged user to gain root privileges by injecting a malicious shared library via ~/.asoundrc. The library executes a constructor function that escalates privileges when loaded by the vmware-vmx process.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: VMWare Workstation 12.5.2 build-4638234
No auth needed
Prerequisites: VMWare Workstation installed · VM with audio configured · Write access to ~/.asoundrc
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC
by bcoles · bashlocalmultiple
https://www.exploit-db.com/exploits/47171

This exploit leverages a local privilege escalation vulnerability in VMware Workstation/Player by abusing the sound subsystem to load a malicious shared library, granting root access. It creates a crafted VM configuration and uses the `.asoundrc` file to trigger the payload.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: VMware Workstation Player <= 12.5.5, VMware Workstation Pro <= 12.5.5
Auth required
Prerequisites: Local access to a vulnerable VMware Workstation/Player installation · User must have permissions to create files in their home directory
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
by Jann Horn, bcoles · rubypoclinux
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/vmware_alsa_config.rb

This Metasploit module exploits CVE-2017-4915, a local privilege escalation vulnerability in VMware Workstation Pro and Player on Linux. It leverages an ALSA configuration file to load and execute a malicious shared object as root when a virtual machine with an attached sound card is launched.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: VMware Workstation Pro/Player < 12.5.6
Auth required
Prerequisites: Local access to a vulnerable VMware installation · GCC for compiling the shared object · Writable directory and home directory
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/98566
Patch, Vendor Advisory x_refsource_confirm
https://www.vmware.com/security/advisories/VMSA-2017-0009.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1038525
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/42045/

Scores

CVSS v3 7.8
EPSS 0.1156
EPSS Percentile 93.8%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-863
Status published
Products (3)
VMware/Workstation Pro/Player All 12.x versions prior to version 12.5.6
vmware/workstation_player 12.0.0
vmware/workstation_pro 12.0.0
Published May 22, 2017
Tracked Since Feb 18, 2026