CVE-2021-21974:Heap Overflow Vulnerability in VMware ESXi OpenSLP Service

splash
Back

Description Preview

A critical heap overflow vulnerability (CVE-2021-21974) exists in the OpenSLP service implementation in VMware ESXi. This vulnerability allows an attacker on the same network segment with access to port 427 to execute arbitrary code remotely on the affected ESXi host. The vulnerability affects multiple versions of VMware ESXi, including ESXi 7.0, 6.7, and 6.5 prior to specific security patches.

Overview

The vulnerability (CWE-787: Out-of-bounds Write) exists in the OpenSLP (Service Location Protocol) service used by VMware ESXi. OpenSLP is a service discovery protocol that allows computers and other devices to find services in a local area network. When exploited, this heap overflow vulnerability could allow a malicious actor to execute arbitrary code with the privileges of the OpenSLP service on the ESXi host. Since the service typically runs with elevated privileges, successful exploitation could lead to complete compromise of the affected system. An attacker must have network access to port 427 on the ESXi host to exploit this vulnerability, but no authentication is required.

Remediation

VMware has released patches to address this vulnerability. Organizations should update to the following versions or later:

  • ESXi 7.0: Update to ESXi70U1c-17325551 or later
  • ESXi 6.7: Update to ESXi670-202102401-SG or later
  • ESXi 6.5: Update to ESXi650-202102101-SG or later

If patching is not immediately possible, consider implementing the following mitigations:

  1. Disable the OpenSLP service if it is not required in your environment
  2. Implement network segmentation to restrict access to port 427
  3. Use firewall rules to limit access to the ESXi management interfaces, including port 427
  4. Monitor for suspicious network traffic targeting port 427

References

  1. VMware Security Advisory: https://www.vmware.com/security/advisories/VMSA-2021-0002.html
  2. Zero Day Initiative Advisory: https://www.zerodayinitiative.com/advisories/ZDI-21-250/
  3. Packet Storm Security - Exploit Details: http://packetstormsecurity.com/files/162957/VMware-ESXi-OpenSLP-Heap-Overflow.html
  4. CWE-787: Out-of-bounds Write: https://cwe.mitre.org/data/definitions/787.html

Industry ExposureMost to least
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.

  1. Manufacturing: Medium
    Manufacturing
  2. Health Care & Social Assistance: Low
    Health Care & Social Assistance
  3. Public Administration: Low
    Public Administration
  4. Finance and Insurance: Low
    Finance and Insurance
  5. Management of Companies & Enterprises: Low
    Management of Companies & Enterprises
  6. Other Services (except Public Administration): Low
    Other Services (except Public Administration)
  7. Retail Trade: Low
    Retail Trade
  8. Transportation & Warehousing: Low
    Transportation & Warehousing
  9. Professional, Scientific, & Technical Services: Low
    Professional, Scientific, & Technical Services
  10. Arts, Entertainment & Recreation: Low
    Arts, Entertainment & Recreation
  11. Educational Services: Low
    Educational Services
  12. Utilities: Low
    Utilities
  13. Accommodation & Food Services: Low
    Accommodation & Food Services
  14. Administrative, Support, Waste Management & Remediation Services: Low
    Administrative, Support, Waste Management & Remediation Services
  15. Agriculture, Forestry Fishing & Hunting: Low
    Agriculture, Forestry Fishing & Hunting
  16. Construction: Low
    Construction
  17. Information: Low
    Information
  18. Mining: Low
    Mining
  19. Real Estate Rental & Leasing: Low
    Real Estate Rental & Leasing
  20. Wholesale Trade: Low
    Wholesale Trade

Focus on What Matters

  1. See Everything.
  2. Identify True Risk.
  3. Proactively Mitigate Threats.

Let's talk!

background