CVE-2019-5544
VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability
Description
CVE-2019-5544 is a critical heap-based buffer overflow vulnerability in OpenSLP as used in VMware ESXi and Horizon Desktop as a Service (DaaS). The vulnerability allows an attacker with network access to port 427 to overwrite the heap of the OpenSLP service, resulting in remote code execution. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild, including known use in ransomware campaigns. With an EPSS score of 92.69% (99.75th percentile), this VMware ESXi vulnerability has a near-certain probability of exploitation and poses a severe threat to virtualization infrastructure.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| vmware | horizon daas | >= 8.0.0, < 9.0.0.0 |
| vmware | esxi | 6.0; 6.5; 6.7 |
| redhat | enterprise linux desktop | 6.0; 7.0 |
| redhat | enterprise linux for ibm z systems | 6.0_s390x; 7.0_s390x |
| redhat | enterprise linux for ibm z systems eus | 7.7_s390x |
| redhat | enterprise linux for power big endian | 6.0_ppc64; 7.0_ppc64 |
| redhat | enterprise linux for power big endian eus | 7.7_ppc64 |
| redhat | enterprise linux for power little endian | 7.0_ppc64le |
| redhat | enterprise linux for power little endian eus | 7.7_ppc64le |
| redhat | enterprise linux server | 6.0; 7.0 |
| redhat | enterprise linux server aus | 7.7 |
| redhat | enterprise linux server eus | 7.7 |
| redhat | enterprise linux server tus | 7.7 |
| redhat | enterprise linux workstation | 6.0; 7.0 |
| openslp | openslp | <= 2.0.0 |
| fedoraproject | fedora | 30; 31 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://www.openwall.com/lists/oss-security/2019/12/10/2(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2019/12/11/2(Mailing List, Third Party Advisory)
- http://www.vmware.com/security/advisories/VMSA-2019-0022.html(Patch, Vendor Advisory)
- https://access.redhat.com/errata/RHSA-2019:4240(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2020:0199(Third Party Advisory)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DA3LYAJ2NRKMOZLZOQNDJ5TNQRFMWGHF/(Release Notes)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZPXXJZLPLAQULBCJVI5NNWZ3PGWXGXWG/(Release Notes)
- https://security.gentoo.org/glsa/202005-12(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-5544(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
Out-of-bounds write is a vulnerability that occurs when software writes data to a memory location outside the intended boundaries of a buffer. In the case of CVE-2019-5544, the OpenSLP service in VMware ESXi and Horizon DaaS contains a heap overwrite flaw that allows an attacker to corrupt heap memory through specially crafted SLP requests sent to port 427, ultimately enabling arbitrary code execution on the hypervisor.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2019-5544 carries a CVSS 3.1 score of 9.8 (CRITICAL), representing the highest practical severity rating. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication, and needs no user interaction. Successful exploitation completely compromises the confidentiality, integrity, and availability of the affected VMware ESXi host or Horizon DaaS appliance, potentially granting the attacker control over all virtual machines running on the hypervisor. The EPSS score of 92.69% places this vulnerability in the 99.75th percentile, indicating near-certain exploitation activity. This vulnerability is known to be used in ransomware campaigns, making it an especially high-priority threat for organizations running VMware virtualization infrastructure.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2019-5544 in the wild through its KEV catalog, and this vulnerability is known to be used in ransomware campaigns targeting VMware ESXi environments. The EPSS score of 92.69% (99.75th percentile) indicates near-certain exploitation activity. While no public exploit code with an "Exploit" tag was identified in the NVD references, the active use in ransomware operations demonstrates that weaponized exploits exist and are actively deployed by threat actors. Federal agencies were required to remediate this vulnerability by 2022-05-03 per CISA’s binding operational directive.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Install the VMware security patches from VMSA-2019-0022 for ESXi versions 6.0, 6.5, and 6.7.
- Verify that all VMware ESXi hosts (versions 6.0, 6.5, 6.7) and Horizon DaaS appliances (versions 8.x before 9.0.0.0) have been updated. Also update OpenSLP installations on affected Red Hat Enterprise Linux and Fedora systems.
- Block network access to port 427 (SLP) on ESXi hosts using firewall rules, as the vulnerability requires network access to this specific port. Disable the SLP service on ESXi hosts if not required.
- Monitor ESXi host logs for indicators of compromise, including unusual process execution, unexpected SLP traffic patterns, and signs of ransomware activity such as VM encryption or datastore manipulation.
- Implement network segmentation to isolate ESXi management interfaces from general network traffic, and ensure vMotion and management networks are not accessible from untrusted zones.
Technical Details
CVE-2019-5544 is a heap-based buffer overflow vulnerability in the OpenSLP implementation used by VMware ESXi and Horizon DaaS. The flaw occurs when the OpenSLP service processes specially crafted Service Location Protocol (SLP) requests on port 427, allowing an attacker to write beyond the allocated heap buffer boundaries. This heap overwrite can corrupt adjacent heap metadata and data structures, enabling attackers to gain control of execution flow through heap exploitation techniques such as corrupting function pointers or vtable entries. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms that the vulnerability is network-accessible via port 427, trivially exploitable, and requires neither authentication nor user interaction, resulting in complete compromise of the hypervisor’s confidentiality, integrity, and availability.
Frequently Asked Questions
Is CVE-2019-5544 being actively exploited?
Yes. CVE-2019-5544 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation. This vulnerability is also known to be used in ransomware campaigns targeting VMware ESXi environments. The EPSS score of 92.69% (99.75th percentile) indicates near-certain exploitation activity.
What products are affected by CVE-2019-5544?
CVE-2019-5544 primarily affects VMware ESXi versions 6.0, 6.5, and 6.7, as well as VMware Horizon DaaS versions 8.x before 9.0.0.0. Additionally, OpenSLP versions up to 2.0.0 are affected, impacting Red Hat Enterprise Linux (6.0, 7.0) and Fedora (30, 31) distributions that bundle OpenSLP.
How do I fix CVE-2019-5544?
Apply updates per vendor instructions by installing the patches from VMware security advisory VMSA-2019-0022. For Red Hat systems, apply the RHSA-2019:4240 and RHSA-2020:0199 updates. As an immediate mitigation, block port 427 on ESXi hosts and disable the SLP service if not required.
How severe is CVE-2019-5544?
CVE-2019-5544 has a CVSS 3.1 score of 9.8 (CRITICAL). This is a maximum-severity vulnerability with confirmed ransomware usage, near-certain exploitation probability (EPSS 92.69%), and the potential to compromise entire virtualization environments including all hosted virtual machines.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.