CVE-2023-29552
Service Location Protocol (SLP) Denial-of-Service Vulnerability
Description
CVE-2023-29552 is a high-severity vulnerability in the Service Location Protocol (SLP, RFC 2608) that allows an unauthenticated, remote attacker to register arbitrary services and abuse the protocol to conduct denial-of-service (DoS) amplification attacks using spoofed UDP traffic. The vulnerability affects multiple products implementing SLP, including VMware ESXi, SUSE Linux Enterprise Server, NetApp SMI-S Provider, and SUSE Manager Server. With a CVSS score of 7.5 and an EPSS score of 93.0%, CVE-2023-29552 poses a significant threat to internet-facing services that have SLP enabled. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of November 29, 2023, confirming active exploitation in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| netapp | smi-s provider | - |
| suse | manager server | - |
| suse | linux enterprise server | 11; 12; 15 |
| vmware | esxi | < 7.0 |
| service location protocol project | service location protocol | - |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://blogs.vmware.com/security/2023/04/vmware-response-to-cve-2023-29552-reflective-denial-of-service-dos-amplification-vulnerability-in-slp.html(Third Party Advisory)
- https://curesec.com/blog/article/CVE-2023-29552-Service-Location-Protocol-Denial-of-Service-Amplification-Attack-212.html(Exploit, Third Party Advisory)
- https://datatracker.ietf.org/doc/html/rfc2608(Technical Description)
- https://github.com/curesec/slpload(Product)
- https://security.netapp.com/advisory/ntap-20230426-0001/(Third Party Advisory)
- https://www.bitsight.com/blog/new-high-severity-vulnerability-cve-2023-29552-discovered-service-location-protocol-slp(Exploit, Third Party Advisory)
- https://www.cisa.gov/news-events/alerts/2023/04/25/abuse-service-location-protocol-may-lead-dos-attacks(Third Party Advisory, US Government Resource)
- https://www.suse.com/support/kb/doc/?id=000021051(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-29552(US Government Resource)
Weakness Type
Protocol Design Flaw
CVE-2023-29552 does not map to a specific CWE in the NVD database. The underlying weakness is a protocol design flaw in the Service Location Protocol (SLP) as defined in RFC 2608. SLP allows unauthenticated service registration by design, which attackers can abuse to register large numbers of arbitrary services and then use the protocol's response mechanism to amplify spoofed UDP traffic for denial-of-service attacks. The amplification factor can be significant, making even a small volume of attacker traffic capable of generating massive flooding against target systems.
Learn more: RFC 2608 — Service Location Protocol
Impact Analysis
CVE-2023-29552 carries a CVSS v3.1 score of 7.5 (High severity) and is remotely exploitable over the network without any authentication or user interaction. Attack Complexity (Low): Exploiting this vulnerability requires no special conditions, and the attack can be launched by any attacker capable of sending spoofed UDP packets. Privileges Required (None): No credentials or prior access are needed, as SLP service registration is unauthenticated by design. Availability Impact (High): The primary impact is a severe denial-of-service condition, where the amplification factor allows attackers to generate disproportionately large response traffic directed at victim systems. The EPSS score of 93.0% (99.8th percentile) indicates near-certain exploitation activity across the internet. While confidentiality and integrity are not directly impacted, the DoS amplification capability makes CVE-2023-29552 a potent weapon for volumetric attacks that can disrupt critical services and infrastructure. Systems running VMware ESXi, SUSE Linux Enterprise Server, and other SLP-enabled services on the internet are particularly at risk.
Exploit Maturity
Public exploit code is available for CVE-2023-29552. Proof-of-concept tools have been published, including an exploit documented by Curesec and a dedicated tool available on GitHub (slpload). Additionally, Bitsight published research detailing the discovery and exploitation methodology. CISA has confirmed active exploitation in the wild by adding CVE-2023-29552 to the Known Exploited Vulnerabilities catalog with a remediation deadline of November 29, 2023. The EPSS score of 93.0% (99.8th percentile) indicates near-certain exploitation activity, consistent with the publicly available tooling and the protocol-level nature of this vulnerability that affects any SLP-enabled system exposed to the internet.
Remediation
- Disable SLP on all systems where it is not required, as directed by CISA's KEV catalog recommendation to apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. For VMware ESXi, refer to VMware's security advisory for disabling SLP on ESXi hosts.
- Block SLP traffic at the network perimeter by filtering UDP and TCP port 427 at firewalls and border routers to prevent external access to SLP services. Ensure that SLP is not accessible from untrusted networks.
- Apply vendor-specific patches and mitigations: for SUSE systems, follow the guidance in SUSE KB doc 000021051; for NetApp products, consult NetApp advisory ntap-20230426-0001.
- Monitor network traffic for SLP abuse indicators, including unusual volumes of UDP port 427 traffic, unexpected SLP service registrations, and outbound traffic patterns consistent with amplification attacks originating from your infrastructure.
- Conduct an inventory of SLP-enabled systems across your environment to identify all instances where SLP is running, particularly on internet-facing systems, and disable or restrict the protocol on each identified system.
Technical Details
CVE-2023-29552 exploits a fundamental design weakness in the Service Location Protocol (SLP) as specified in RFC 2608. The protocol allows any network participant to register services via unauthenticated UDP requests on port 427. An attacker can register a large number of arbitrary, crafted services on an SLP-enabled system, inflating the size of service responses. By then sending service request queries with a spoofed source IP address (the victim's IP), the attacker causes the SLP server to send large response packets to the victim, creating a significant amplification effect. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms that the attack is network-based, requires no privileges, no user interaction, and has low complexity, with the sole impact being high availability disruption. The amplification factor is particularly concerning because attackers can register services with long attribute strings to maximize response sizes, potentially achieving amplification ratios that make even modest attacker bandwidth capable of generating devastating volumetric floods against target infrastructure.
Frequently Asked Questions
Is CVE-2023-29552 being actively exploited?
Yes, CVE-2023-29552 is actively exploited. CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of November 29, 2023. Public exploit code and tools are readily available, and the EPSS score of 93.0% confirms widespread exploitation activity targeting internet-exposed SLP services.
What products are affected by CVE-2023-29552?
CVE-2023-29552 affects any product implementing the Service Location Protocol (SLP). Specifically identified affected products include VMware ESXi, SUSE Linux Enterprise Server, SUSE Manager Server, NetApp SMI-S Provider, and the SLP reference implementation. Any system with SLP enabled on port 427 is potentially vulnerable.
How do I fix CVE-2023-29552?
The primary remediation is to disable SLP on all systems where it is not strictly required. Block UDP and TCP port 427 at network perimeters to prevent external access to SLP services. For VMware ESXi, SUSE, and NetApp systems, apply the vendor-specific mitigations referenced in the Remediation section.
How severe is CVE-2023-29552?
CVE-2023-29552 has a CVSS v3.1 score of 7.5 (High severity) with the primary impact being denial-of-service through traffic amplification. The EPSS score of 93.0% (99.8th percentile) indicates near-certain exploitation. The vulnerability is particularly dangerous because it can be used as an amplification vector for volumetric DDoS attacks against third-party targets.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.