CVE-2021-38645

What is Microsoft Open Management Infrastructure (OMI)?

Open Management Infrastructure (OMI) is Microsoft's open-source implementation of the DMTF CIM/WBEM standard for systems management on Linux and Unix — essentially the Linux equivalent of Windows Management Instrumentation (WMI). OMI is used by Microsoft to provide management capabilities in Azure VM management extensions, including: System Center Operations Manager (SCOM), Azure Log Analytics (OMS agent), Azure Automation State Configuration, and Azure Diagnostics. The critical issue: Microsoft silently installs OMI as a dependency of these management extensions — Linux VM administrators who enable monitoring or management extensions in Azure get OMI installed without explicit notification or documentation of the security implications. OMI runs as root and listens on local UNIX sockets and, in some configurations, network ports.

Overview

CVE-2021-38645 is a local privilege escalation vulnerability in Microsoft's OMI agent, part of the OMIGOD cluster of four CVEs (CVE-2021-38647, CVE-2021-38645, CVE-2021-38648, CVE-2021-38649) discovered by Wiz security research team in September 2021. Wiz researchers found that OMI was silently installed on a large proportion of Azure Linux VMs. A low-privileged local user on an Azure Linux VM with OMI installed can exploit a vulnerability in OMI's UNIX socket handler to escalate to root privileges without authentication. CISA added this to KEV in November 2021, confirming active exploitation.

The remote code execution variant, CVE-2021-38647 (CVSS 9.8), is even more severe — allowing unauthenticated RCE when OMI's management ports are exposed to the network.

Affected Versions

Technical Details

• Root cause: An authorization/authentication bypass in OMI's local UNIX socket handler — a low-privileged local user can send specially crafted messages to the OMI management socket and trigger privileged operations without proper authentication
• Attack vector: Local (AV:L) with low privileges (PR:L) — the attacker needs a shell on the Azure Linux VM (as any non-root user) to exploit the OMI UNIX socket
• Root escalation: OMI runs as root; exploiting the UNIX socket allows a low-privileged user to execute arbitrary commands in the OMI root context, achieving full root access on the VM
• Silent installation: Azure VM administrators are often unaware that OMI is installed because it is a hidden dependency of common management extensions — this "phantom" attack surface is what made OMIGOD particularly impactful
• OMIGOD cluster: The four OMIGOD CVEs range from local privilege escalation (CVE-2021-38645, CVE-2021-38648, CVE-2021-38649) to remote code execution (CVE-2021-38647, CVSS 9.8) — all in the same OMI agent
• Azure scope: Primarily affects Azure Linux VMs with management extensions enabled; non-Azure OMI deployments may also be affected

Discovery

Discovered by Nir Ohfeld, Shir Tamari, and the Wiz research team, who published the OMIGOD research simultaneously with Microsoft's September 2021 Patch Tuesday fixes. Wiz estimated that thousands of Azure customers had OMI silently installed across their Linux VM fleets, with many unaware of its presence.

Exploitation Context

The OMIGOD disclosure was significant both for the technical severity and the policy implications — Microsoft was silently installing a root-running management agent without adequate customer disclosure. Following the disclosure, Microsoft patched OMI and updated extension distribution to include the fixed version. However, Azure customers who did not have automatic extension updates enabled remained vulnerable until manually updated. CISA's KEV addition confirms active exploitation in Azure environments, likely by threat actors scanning Azure for vulnerable OMI deployments.

Remediation

1. Update OMI to version 1.6.8-1 or later — Microsoft pushed automatic updates to many Azure management extensions, but verify: dpkg -l omi or rpm -qa omi to check the installed version
2. For Azure VMs: check the installed version of all management extensions (OMS agent, SCOM, Azure Automation) and update to versions that bundle OMI 1.6.8-1+
3. Restrict the OMI UNIX socket permissions to limit local user access if the management extension is required
4. For the network-accessible OMIGOD variant (CVE-2021-38647): ensure OMI ports 5985/5986/1270 are not exposed to untrusted networks via NSG (Network Security Group) rules
5. If management extensions are not required, disable or remove them from Azure VMs to eliminate the OMI attack surface entirely