CVE DatabaseCVE-2021-38645

Updated 2026-08-10한국어 권고문 →

CVE-2021-386457.8/HIGHCISA KEV

Microsoft Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability (CVE-2021-38645) Security Advisory

⚡ Jump to Patch

Affected Vendors

microsoft

Affected Components

open management infrastructure, omi

Published Date

2021-09-15

CVSS v3.1

7.8

HIGH

EPSS (30d)

2.7%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Microsoft Open Management Infrastructure (OMI) versions prior to 1.6.8-1, commonly deployed in Azure Linux environments

Impact

Local unprivileged attackers can execute arbitrary commands with root privileges, leading to full system compromise

Mitigation

Immediately upgrade OMI to version 1.6.8-1 or higher, and restrict access to OMI-related ports

Affected Products & Version Scope

All versions of Microsoft Open Management Infrastructure (OMI) prior to 1.6.8-1

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Upgrade the OMI package to the latest secure version using the system package manager.

bash

# For Debian/Ubuntu-based systems
sudo apt-get update && sudo apt-get --only-upgrade install omi -y

# For RHEL/CentOS-based systems
sudo yum clean all && sudo yum update omi -y

2. Temporary Workaround & Hardening Configuration

If immediate patching is not feasible, block local and external access to OMI ports (5686, 5985, 5986) using host-based firewalls.

bash

# Block OMI ports using iptables
sudo iptables -A INPUT -p tcp --dport 5686 -j DROP
sudo iptables -A INPUT -p tcp --dport 5985 -j DROP
sudo iptables -A INPUT -p tcp --dport 5986 -j DROP
sudo service iptables save

3. Log Audit & IoC Verification Commands

Execute the following script to verify the installed OMI version and determine vulnerability status.

bash

# Check OMI installation and version status
if [ -f '/opt/omi/bin/omiserver' ]; then
  OMI_VER=$(/opt/omi/bin/omiserver -v 2>&1 | grep -oE '[0-9]+\.[0-9]+\.[0-9]+-[0-9]+')
  echo 'Installed OMI Version: '$OMI_VER
  if [ '$(echo -e "$OMI_VER\
1.6.8-1" | sort -V | head -n1)' != '1.6.8-1' ]; then
    echo '[WARNING] System is VULNERABLE to CVE-2021-38645. Upgrade required.'
  else
    echo '[INFO] System is secure.'
  fi
else
  echo '[INFO] OMI is not installed on this system.'
fi

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

Datadog Cloud & Kubernetes Security

As this vulnerability is actively exploited in the wild (CISA KEV), prioritize auditing and patching OMI across all Linux and Azure VM instances immediately.

Detect Container Escape & Privilege Escalation Across Your Kubernetes Fleet

Continuous eBPF-based runtime threat detection and posture management for AWS, GCP, Azure, Docker, and Kubernetes workloads.

Real-Time Production Container CVE Mapping

Start 14-Day Free Cloud Security Trial

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2021-38645) is an elevation of privilege vulnerability in Microsoft's Open Management Infrastructure (OMI), an open-source management framework for Linux systems. Due to a critical flaw in OMI's authorization and request validation logic, the system fails to properly validate identity tokens under specific local IPC or socket communication contexts, allowing unauthenticated local users to execute actions with elevated privileges.

2. Exploitation Mechanics & Attack Scenario

An attacker must first obtain local access to the target Linux system with low-privilege user rights. By crafting a specific request to the OMI daemon (omiserver) via local communication channels and omitting or sending an empty authorization header, the OMI engine incorrectly treats the request as an internal, pre-authorized command. Consequently, the daemon executes the attacker's payload with root privileges.

3. Infrastructure & Business Impact

Since OMI is silently deployed as a dependency for various Azure management extensions (such as Log Analytics and Azure Diagnostics), this vulnerability poses a widespread risk to cloud environments. Successful exploitation allows attackers to gain full root access, compromise sensitive cloud credentials, exfiltrate proprietary data, and potentially pivot laterally across the virtual network, causing severe operational disruption.

Official Vendor Advisories & References

NVD Original English Description

Open Management Infrastructure Elevation of Privilege Vulnerability

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38645

Source: secure@microsoft.com · Patch, Vendor Advisory

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38645

Source: af854a3a-2127-422b-91ae-364da2661108 · Patch, Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38645

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

Frequently Asked SecOps Questions (CVE-2021-38645)

FAQ

Q1. How critical is CVE-2021-38645 and is it actively exploited in the wild?

CVE-2021-38645 is rated CVSS 7.8 (HIGH) with a 30-day EPSS exploitation probability of 2.7%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2021-38645?

Primary impacted vendors include microsoft across open management infrastructure, omi. Scope summary: All versions of Microsoft Open Management Infrastructure (OMI) prior to 1.6.8-1

Q3. What temporary mitigations or workarounds exist for CVE-2021-38645 before patching?

[Mitigation] Immediately upgrade OMI to version 1.6.8-1 or higher, and restrict access to OMI-related ports Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION