CVE-2021-38645

CVE-2021-38645 is an elevation of privilege vulnerability in Microsoft's Open Management Infrastructure (OMI), a management agent that Microsoft silently deploys on Azure Linux virtual machines through services such as Azure Security Center, Azure Sentinel, Azure Automation (State Configuration and Update Management), Azure Diagnostics (LAD), the Log Analytics agent, and Container Monitoring, and which is also used by System Center Operations Manager and Azure Stack Hub. A local attacker who already has low-privileged access to a machine running OMI can exploit the flaw to elevate privileges, gaining high-impact control over the confidentiality, integrity, and availability of the system (CVSS 3.1: 7.8, local attack vector, low privileges required, no user interaction). Any Azure tenant whose Linux VMs carry the silently installed OMI agent, as well as on-premises deployments that use OMI via System Center Operations Manager, is affected. The bug is one of four 'OMIGOD' flaws Microsoft patched in September 2021; CISA added it to the Known Exploited Vulnerabilities catalog on November 3, 2021, and researchers reported Mirai botnet activity exploiting OMI vulnerabilities, confirming in-the-wild exploitation even though no public proof-of-concept is known.

What to do: Apply Microsoft's patched OMI update across all affected products per vendor instructions, as required by the CISA KEV listing, and inventory Linux hosts and Azure management extensions for OMI (e.g., OMI/omsagent packages under /opt/omi) to confirm every agent has been updated. Because Azure services silently re-deploy OMI, re-check versions after updating and control which services auto-install it. Also limit exposure of OMI's HTTP listener to mitigate the related remote 'OMIGOD' RCE (CVE-2021-38647) on the same installs.