Remote Code Execution Vulnerability
HighCVE-2022-21991 · Published May 25, 2022 · updated May 30, 2022
A remote code execution vulnerability exists in VS Code 1.64.0 and earlier versions when debugging VS Code extensions remotely, for example using the Visual Studio Code Remote - SSH extension to connect to a machine and then develop a VS Code extension on that machine. When debugging VS Code extensions remotely, the remote extension host process would be launched in a way in which it would listen for debugger connections on all network interfaces. ### Patches The fix is available starting with **VS Code 1.64.1**. The fix (https://github.com/microsoft/vscode/commit/91f7694e68af5b5a9f05d920a5f0420dcb9c4ff5) mitigates this attack by launching the remote extension host in a way in which it listens for debugger connections only on the loopback interface when debugging VS Code extensions remotely. ### Workarounds There are no known workarounds for debugging VS Code extensions remotely. An alternative would be to develop and debug VS Code extensions locally. ### References * The patch for this can be found at https://github.com/microsoft/vscode/commit/91f7694e68af5b5a9f05d920a5f0420dcb9c4ff5 * An issue for this can be found at https://github.com/microsoft/vscode/issues/142541 * MSRC ...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| vscode Product | < 1.64.1 | 1.64.1 |
Details and references
A remote code execution vulnerability exists in VS Code 1.64.0 and earlier versions when debugging VS Code extensions remotely, for example using the Visual Studio Code Remote - SSH extension to connect to a machine and then develop a VS Code extension on that machine. When debugging VS Code extensions remotely, the remote extension host process would be launched in a way in which it would listen for debugger connections on all network interfaces. ### Patches The fix is available starting with **VS Code 1.64.1**. The fix (https://github.com/microsoft/vscode/commit/91f7694e68af5b5a9f05d920a5f0420dcb9c4ff5) mitigates this attack by launching the remote extension host in a way in which it listens for debugger connections only on the loopback interface when debugging VS Code extensions remotely. ### Workarounds There are no known workarounds for debugging VS Code extensions remotely. An alternative would be to develop and debug VS Code extensions locally. ### References * The patch for this can be found at https://github.com/microsoft/vscode/commit/91f7694e68af5b5a9f05d920a5f0420dcb9c4ff5 * An issue for this can be found at https://github.com/microsoft/vscode/issues/142541 * MSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21991
- Severity from
- GitHub (reviewed advisory)
More Microsoft advisories
All Microsoft| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Oct 112022 | Information Disclosure Vulnerability | Medium | 1.71.1 |
| Oct 112022 | Remote Code Execution Vulnerability | High | 1.71.1 |
| Sep 142022 | Elevation of Privilege Vulnerability | High | 1.71.1 |
| May 252022 | Spoofing Vulnerability | High | 1.65.1 |
| May 252022 | Elevation of Privilege Vulnerability | High | 1.66.2 |
| May 252022 | Remote Code Execution Vulnerability | High | 1.67.1 |