CVE-2021-21974
HIGHCVSS Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
OpenSLP as used in ESXi (7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5 before ESXi650-202102101-SG) has a heap-overflow vulnerability. A malicious actor residing within the same network segment as ESXi who has access to port 427 may be able to trigger the heap-overflow issue in OpenSLP service resulting in remote code execution.
Analysis
VMware ESXi versions 7.0 before U1c, 6.7 before specific patches, and 6.5 before specific patches contain a heap overflow in the OpenSLP service accessible on port 427. An attacker on the same network segment can trigger remote code execution on the ESXi hypervisor, compromising all virtual machines hosted on the server.
Technical Context
The OpenSLP (Service Location Protocol) service on ESXi listens on UDP/TCP port 427 and is accessible from the management network. A heap overflow in the SLP message parsing allows an attacker on the same network segment to execute arbitrary code in the context of the SLP daemon, which runs with high privileges on the ESXi host.
Affected Products
['VMware ESXi 7.0 before ESXi70U1c-17325551', 'VMware ESXi 6.7 before ESXi670-202102401-SG', 'VMware ESXi 6.5 before ESXi650-202102101-SG']
Remediation
Apply VMware security patches immediately. Disable the OpenSLP service if not required (esxcli network firewall ruleset set -e false -r CIMSLP). Restrict port 427 access via ESXi firewall rules. Segment ESXi management networks from general user networks. Implement offline VM backups.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today