CVE-2021-38645
Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability
Description
CVE-2021-38645 is a HIGH privilege escalation vulnerability in Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions, carrying a CVSS 3.1 score of 7.8. The vulnerability allows a local attacker with low privileges to escalate to higher privileges on affected systems. OMI is an open-source CIM management agent used across Azure Linux VMs, and this vulnerability was part of the broader "OMIGOD" vulnerability cluster disclosed in September 2021. This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2021-11-17. With an EPSS score of 0.14607 (94.37th percentile), this vulnerability demonstrates significant real-world exploitation activity and should be prioritized for immediate remediation.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | azure automation state configuration | - |
| microsoft | azure automation update management | - |
| microsoft | azure diagnostics \(lad\) | - |
| microsoft | azure security center | - |
| microsoft | azure sentinel | - |
| microsoft | azure stack hub | - |
| microsoft | container monitoring solution | - |
| microsoft | log analytics agent | - |
| microsoft | open management infrastructure | < 1.6.8-1 |
| microsoft | system center operations manager | - |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38645(Patch, Vendor Advisory)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38645(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38645(US Government Resource)
Weakness Type
Unspecified Weakness Type
CVE-2021-38645 does not have an officially assigned CWE classification. The vulnerability involves a local privilege escalation flaw in the Open Management Infrastructure (OMI) agent that runs on Azure Linux virtual machines. OMI processes incoming management requests, and flaws in its privilege handling allowed authenticated local users to execute operations with elevated privileges.
This vulnerability is part of the "OMIGOD" family of vulnerabilities disclosed in September 2021, which collectively affected millions of Azure Linux VMs. The privilege escalation mechanism exploits weaknesses in how OMI validates and processes local requests, enabling attackers who have already gained initial access to a system to escalate their privileges to root-level access.
Impact Analysis
CVE-2021-38645 carries a CVSS 3.1 score of 7.8 (HIGH) with Unchanged Scope.
Confidentiality (HIGH): Successful exploitation grants the attacker elevated access to sensitive data on the affected system, including credentials, configuration files, encryption keys, and potentially data from other Azure services connected to the compromised VM.
Integrity (HIGH): With elevated privileges, attackers can modify critical system files, install persistent backdoors, alter security configurations, tamper with logs, or deploy additional malicious payloads across the environment.
Availability (HIGH): Complete disruption of the affected system is possible, including denial of service, system crashes, destruction of data, or rendering the virtual machine and its hosted services inoperable.
Scope Unchanged: The vulnerability impact is contained within the vulnerable OMI component's environment. However, since OMI runs with elevated privileges on Azure Linux VMs, gaining control of it effectively means full system compromise.
With an EPSS score of 0.14607 (94.37th percentile), this vulnerability ranks among the most likely to be exploited in real-world attacks, requiring urgent attention.
Exploit Maturity
CVE-2021-38645 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.
Exploit status: This vulnerability was actively exploited as part of the "OMIGOD" vulnerability cluster. The EPSS score of 0.14607 (94.37th percentile) confirms a high real-world exploitation likelihood. Proof-of-concept exploit code was publicly available shortly after disclosure.
Ransomware association: As of the latest KEV data, no direct ransomware association has been confirmed for CVE-2021-38645. However, the confirmed exploitation in the wild means threat actors leveraged this vulnerability as part of broader attack chains.
Attack surface: OMI is automatically installed on Azure Linux VMs when certain management extensions are enabled, meaning many Azure customers were unknowingly exposed. Public exploit code exists, and the vulnerability was widely discussed in the security community following disclosure.
KEV deadline: CISA required federal agencies to remediate this vulnerability by 2021-11-17. All organizations running Azure Linux VMs with OMI should treat this as a critical remediation priority.
Remediation
- Apply vendor patches immediately. Apply updates per vendor instructions. Consult the Microsoft advisory at MSRC for specific patch guidance. Update OMI to version 1.6.8-1 or later.
- Verify affected systems in your Azure environment. Identify all Azure Linux VMs running OMI agents. Check the installed OMI version using
dpkg -l omiorrpm -qa omi. Any version prior to 1.6.8-1 is vulnerable. - Enable automatic extension updates. Configure Azure VM extensions to auto-update to ensure future OMI patches are applied promptly. Review Azure Security Center recommendations for outstanding actions.
- Implement network segmentation. Restrict access to OMI management ports. Ensure that OMI is not exposed on public-facing network interfaces and apply firewall rules to limit access to trusted management networks only.
- Scan for signs of prior exploitation. Review system logs for suspicious privilege escalation events or unauthorized root access. Check for unexpected processes, modified system files, or new user accounts that may indicate compromise.
- Conduct a post-remediation review. After patching, verify the OMI version and confirm the fix is effective. Document the remediation actions taken and update your vulnerability management records.
Technical Details
CVE-2021-38645 is a HIGH-severity privilege escalation vulnerability in Microsoft Open Management Infrastructure (OMI) that requires local access to the system. The attack complexity is low, meaning no specialized conditions are needed beyond having local access. Low-level privileges are required, indicating the attacker needs basic authenticated access. No user interaction is required for exploitation.
Technical mechanism: The vulnerability exists in the Open Management Infrastructure (OMI) agent, which is a UNIX/Linux-based remote management framework used by Azure for VM management. OMI runs as root and processes management operations through a local socket. The privilege escalation occurs because OMI fails to properly validate the credentials and authorization level of local requests, allowing a low-privileged user to execute operations that should require root privileges.
Part of OMIGOD cluster: CVE-2021-38645 was disclosed alongside CVE-2021-38647 (remote code execution), CVE-2021-38648 (privilege escalation), and CVE-2021-38649 (privilege escalation) as part of the "OMIGOD" vulnerability set. While the RCE vulnerability received more attention, the local privilege escalation flaws are equally dangerous in post-exploitation scenarios.
CVSS 3.1 vector analysis: The vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects local access required, low complexity, low privileges needed, no user interaction, unchanged scope, and high impact across all three CIA dimensions.
Frequently Asked Questions
Is CVE-2021-38645 being actively exploited?
Yes, CVE-2021-38645 has been actively exploited in the wild. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and its EPSS score of 0.14607 (94.37th percentile) confirms significant real-world exploitation activity. The vulnerability was part of the widely-targeted "OMIGOD" vulnerability cluster.
Which products are affected by CVE-2021-38645?
CVE-2021-38645 affects Microsoft Open Management Infrastructure (OMI) used in Azure VM Management Extensions. This includes Azure Linux VMs that have OMI installed through various Azure extensions such as Azure Automation, Azure Diagnostics, and System Center Operations Manager. Any OMI version prior to 1.6.8-1 is vulnerable.
How do I fix CVE-2021-38645?
Apply updates per vendor instructions by upgrading OMI to version 1.6.8-1 or later. Check your Azure Linux VMs for the installed OMI version, enable automatic extension updates in Azure, and restrict network access to OMI management ports. After patching, verify the fix and scan for indicators of prior compromise.
How severe is CVE-2021-38645?
CVE-2021-38645 is rated HIGH with a CVSS 3.1 score of 7.8. It enables local privilege escalation on Azure Linux VMs running the OMI agent. The EPSS score of 0.14607 (94.37th percentile) places it among the most likely vulnerabilities to be exploited. CISA required remediation by 2021-11-17.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.