CVE-2021-38649
Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability
Description
CVE-2021-38649 is a HIGH privilege escalation vulnerability in Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions, carrying a CVSS 3.1 score of 7.0. Unlike other OMIGOD vulnerabilities, this variant has high attack complexity, requiring specific conditions to be met for successful exploitation. The vulnerability allows a locally authenticated attacker with low privileges to escalate privileges on affected Azure Linux VMs running OMI agents. This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2021-11-17. With an EPSS score of 0.06512 (90.98th percentile), this vulnerability demonstrates notable real-world exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | azure automation state configuration | - |
| microsoft | azure automation update management | - |
| microsoft | azure diagnostics \(lad\) | - |
| microsoft | azure open management infrastructure | - |
| microsoft | azure security center | - |
| microsoft | azure sentinel | - |
| microsoft | azure stack hub | - |
| microsoft | container monitoring solution | - |
| microsoft | log analytics agent | - |
| microsoft | open management infrastructure | < 1.6.8-1 |
| microsoft | system center operations manager | - |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38649(Patch, Vendor Advisory)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38649(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38649(US Government Resource)
Weakness Type
Unspecified Weakness Type
CVE-2021-38649 does not have an officially assigned CWE classification. The vulnerability is a privilege escalation flaw in the Open Management Infrastructure (OMI) agent used by Azure VM Management Extensions. OMI is an open-source CIM management framework that runs with root privileges on Linux systems for remote and local management operations.
This vulnerability is part of the "OMIGOD" family of vulnerabilities disclosed in September 2021, alongside CVE-2021-38645, CVE-2021-38647, and CVE-2021-38648. While sharing the same affected component, CVE-2021-38649 differs in that it requires high attack complexity, meaning specific environmental conditions or race conditions must be met for successful exploitation. The privilege escalation mechanism allows authenticated local users to bypass authorization boundaries within the OMI agent.
Impact Analysis
CVE-2021-38649 carries a CVSS 3.1 score of 7.0 (HIGH) with Unchanged Scope.
Confidentiality (HIGH): Successful exploitation grants the attacker elevated access to sensitive data on the affected Azure Linux VM, including configuration files, secrets, encryption keys, and data from connected Azure services.
Integrity (HIGH): With elevated privileges, attackers can modify critical system files, install backdoors, alter security configurations, tamper with management agent settings, or deploy malicious payloads.
Availability (HIGH): Complete disruption of the affected system is possible, including service denial, system crashes, data destruction, or rendering the virtual machine and its hosted services inoperable.
Scope Unchanged: The impact is contained within the vulnerable OMI component's environment. Since OMI runs with root privileges, gaining control effectively means full system compromise of the Linux VM.
The high attack complexity requirement (CVSS score 7.0 vs. 7.8 for similar OMIGOD vulnerabilities) indicates that exploitation is more difficult but still feasible, as confirmed by its KEV listing.
Exploit Maturity
CVE-2021-38649 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.
Exploit status: This vulnerability was exploited as part of the broader OMIGOD vulnerability cluster targeting Azure Linux VMs. The EPSS score of 0.06512 (90.98th percentile) indicates significant exploitation activity. The high attack complexity makes it somewhat harder to exploit than its OMIGOD siblings, but working exploits have been developed.
Ransomware association: As of the latest KEV data, no direct ransomware association has been confirmed for CVE-2021-38649. The exploitation has been primarily associated with targeted attacks against Azure cloud infrastructure.
Attack surface: OMI is automatically deployed on Azure Linux VMs through various management extensions, creating a broad attack surface across Azure environments. While the high complexity requirement limits reliability, the widespread deployment of OMI means many potential targets exist.
KEV deadline: CISA required federal agencies to remediate this vulnerability by 2021-11-17. All organizations running Azure Linux VMs with OMI should prioritize updating to the patched OMI version.
Remediation
- Apply vendor patches immediately. Apply updates per vendor instructions. Consult the Microsoft advisory at MSRC for specific patch guidance. Update OMI to version 1.6.8-1 or later.
- Verify affected Azure Linux VMs. Identify all Azure Linux VMs running OMI agents in your environment. Check the installed OMI version using
dpkg -l omiorrpm -qa omi. Any version prior to 1.6.8-1 is vulnerable to this and other OMIGOD CVEs. - Enable automatic extension updates. Configure Azure VM extensions to auto-update to ensure future OMI patches are applied promptly. Review Azure Security Center recommendations for any outstanding actions related to OMI.
- Implement network segmentation. Restrict access to OMI management ports (default 5985/5986). Ensure OMI listeners are not exposed on public-facing network interfaces and apply NSG rules to limit access to trusted management networks.
- Scan for signs of prior exploitation. Review system logs on Azure Linux VMs for suspicious privilege escalation events, unexpected root-level processes, or unauthorized modifications. Check for indicators of compromise across all OMIGOD CVEs simultaneously.
- Conduct a post-remediation review. After patching, verify the updated OMI version is installed correctly. Document all remediation actions and update your vulnerability management records. Consider implementing Azure Defender for servers for ongoing protection.
Technical Details
CVE-2021-38649 is a HIGH-severity privilege escalation vulnerability in Microsoft Open Management Infrastructure (OMI) that requires local access with high attack complexity. Low-level privileges are required, and no user interaction is needed.
Technical mechanism: The vulnerability exists in the OMI agent, a UNIX/Linux-based remote management framework used by Azure for VM management operations. OMI runs as root and processes management requests through local and remote interfaces. The privilege escalation occurs due to improper authorization handling under specific conditions, allowing an authenticated low-privileged user to execute operations that should require root privileges. The high attack complexity indicates that specific timing or environmental conditions must be met.
Distinction from other OMIGOD CVEs: CVE-2021-38649 shares the same OMI component as CVE-2021-38645 (local privilege escalation, low complexity), CVE-2021-38647 (remote code execution), and CVE-2021-38648 (local privilege escalation). The key difference is the high attack complexity requirement, resulting in a lower CVSS score of 7.0 compared to 7.8 for CVE-2021-38645.
CVSS 3.1 vector analysis: The vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H reflects local access required, high complexity, low privileges needed, no user interaction, unchanged scope, and high impact across all three CIA dimensions. The high complexity differentiates this from the simpler OMIGOD privilege escalation variants.
Frequently Asked Questions
Is CVE-2021-38649 being actively exploited?
Yes, CVE-2021-38649 has been actively exploited as part of the OMIGOD vulnerability cluster targeting Azure Linux VMs. It is listed in CISA's KEV catalog with an EPSS score of 0.06512 (90.98th percentile). The high attack complexity makes it harder to exploit than other OMIGOD CVEs but does not prevent determined attackers.
Which products are affected by CVE-2021-38649?
CVE-2021-38649 affects Microsoft Open Management Infrastructure (OMI) used in Azure VM Management Extensions. This includes Azure Linux VMs that have OMI installed through extensions such as Azure Automation, Azure Diagnostics, Log Analytics, and System Center Operations Manager. Any OMI version prior to 1.6.8-1 is vulnerable.
How do I fix CVE-2021-38649?
Update OMI to version 1.6.8-1 or later per Microsoft's advisory. Identify all Azure Linux VMs with OMI agents, enable automatic extension updates, restrict network access to OMI management ports, and scan for indicators of prior compromise. Address all OMIGOD CVEs simultaneously as they affect the same component.
How severe is CVE-2021-38649?
CVE-2021-38649 is rated HIGH with a CVSS 3.1 score of 7.0. The score is lower than other OMIGOD CVEs due to the high attack complexity requirement. The EPSS score of 0.06512 (90.98th percentile) indicates significant exploitation activity. CISA required remediation by 2021-11-17.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.