Coverage for CVE-2021-38647 Remote Code Execution Vulnerability

Technical Articles ID: KB94887
Last Modified: 2024-01-31 10:40:29 Etc/GMT

Environment

Linux systems running Azure's Open Management Infrastructure (OMI) Agent

Summary

Recent updates to this article

Date	Update
January 31, 2024	Removed category tags for End of Life product versions.

To receive email notification when this article is updated, click Subscribe on the right side of the page. You must be logged on to subscribe.

We investigated a recent vulnerability, CVE-2021-38647, reported by Microsoft as part of the September 2021 Patch Tuesday security updates. This vulnerability applies to Azure OMI. This vulnerability is rated with a CVSS(3.1) score of 9.8.

CVE-2021-38647 is considered the most critical of a collection of recent vulnerabilities released by Microsoft, collectively being referred to as the "OMIGOD" vulnerabilities. The full list of vulnerabilities is CVE-2021-38647, CVE-2021-38648, CVE-2021-38645, and CVE-2021-38649. For more information, see the official Microsoft update guide on CVE-2021-38647.

Problem

This vulnerability can be leveraged to remotely gain access with root permissions on a virtual workload running a Linux-based operating system and execute code. By sending an HTTP/S request with the Authorization header removed, an attacker can use this vulnerability to gain root permissions on the victim system.

What is Azure OMI?

The OMI Agent is leveraged in many popular Azure services. Microsoft references Azure Operations Management Suite (OMS) and System Center for Linux, which can be used with on-premises Linux systems.

Solution

It’s important to note that Microsoft has released a patch in the OMI Agent, released on September 11, 2021. System owners can apply the patch to remediate the vulnerability. This patch is available directly from the Microsoft OMI Agent GitHub repository under the 1.6.8-1 release.

IMPORTANT: To be sufficiently protected by the security updates provided by Microsoft for "OMIGOD" vulnerabilities, customers must take manual action to deploy required patches. Azure OMI doesn’t apply this patch automatically.

How can Trellix product solutions help?

We evaluate product coverage across our portfolio. This article will be updated as product coverage is identified.

Product capabilities are available for the following components:

Endpoint Security for Linux Firewall: Block inbound connections for affected ports; block the OMI service from network communications.
EDR/Active Response: Search for connections by port and user privilege.
Real Time Search -
The following query can be used to identify systems running the OMI Agent and the respective version of the service installed:

Software and HostInfo hostname where Software displayname contains omi

The following query can be used to identify traffic coming from the omiengine service:

Processes and CurrentFlow and HostInfo hostname where Processes name equals omiengine
Application Control: Prevent the OMI service from execution.

NOTE: Common OMI ports are 5986, 5985, and 1270. But, custom configurations options for OMI ports are available. Customers should investigate internally what's being used in their environment. Additionally, as further testing is done, these steps will be outlined in more detail.

Additional product coverage is being evaluated for the following products:

Cloud Native Application Protection Platform (CNAPP)
Cloud Workload Protection Platform (CWPP)

To receive continued updates, subscribe to this article and to Support Notification Service (SNS).

Related Information

To receive email notification when this article is updated, click Subscribe on the right side of the page. You must be logged on to subscribe.

To receive information about product updates, sign up for the Support Notification Service.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Coverage for CVE-2021-38647 Remote Code Execution Vulnerability

Environment

Summary

Problem

Solution

Related Information

Affected Products

Languages:

Title

Title

Knowledge Center

Coverage for CVE-2021-38647 Remote Code Execution Vulnerability

Environment

Summary

Problem

Solution

Related Information

Affected Products

Languages:

Choose your region

Title

Title