CVE-2021-21974: VMware Cloud Foundation RCE Vulnerability

CVE-2021-21974 Overview

CVE-2021-21974 is a heap overflow vulnerability in the OpenSLP (Service Location Protocol) service as implemented in VMware ESXi hypervisor. This vulnerability allows a malicious actor residing within the same network segment as an ESXi host, with access to port 427, to trigger a heap overflow condition in the OpenSLP service, potentially resulting in remote code execution. The vulnerability affects multiple versions of VMware ESXi (7.0, 6.7, and 6.5) as well as VMware Cloud Foundation deployments that utilize these ESXi versions.

Critical Impact

Successful exploitation of this heap overflow vulnerability can lead to remote code execution on VMware ESXi hosts, potentially compromising the entire virtualization infrastructure and all hosted virtual machines.

Affected Products

• VMware ESXi 7.0 (before ESXi70U1c-17325551)
• VMware ESXi 6.7 (before ESXi670-202102401-SG)
• VMware ESXi 6.5 (before ESXi650-202102101-SG)
• VMware Cloud Foundation 4.x and 3.x

Discovery Timeline

• February 24, 2021 - CVE-2021-21974 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2021-21974

Vulnerability Analysis

This heap overflow vulnerability exists in the OpenSLP service running on VMware ESXi hypervisors. The OpenSLP service, which operates on UDP and TCP port 427, is designed to allow networked devices to discover services on a local network. The vulnerability stems from improper bounds checking when processing SLP messages, allowing an attacker to overflow a heap-allocated buffer.

When a specially crafted SLP message is sent to the vulnerable service, the heap memory corruption can be leveraged to achieve arbitrary code execution. Since ESXi runs as the hypervisor layer controlling all virtual machines, successful exploitation grants the attacker complete control over the host and all virtualized workloads running on it.

The attack requires the attacker to be on the same network segment (adjacent network) as the target ESXi host, which limits the attack surface compared to vulnerabilities exploitable over the internet. However, in enterprise environments where ESXi management networks may be accessible from multiple locations, this still represents a significant risk.

Root Cause

The root cause of CVE-2021-21974 is a heap-based buffer overflow (CWE-787: Out-of-bounds Write) in the OpenSLP implementation used by VMware ESXi. The vulnerability occurs due to insufficient validation of the length fields in incoming SLP protocol messages. When the OpenSLP service processes a maliciously crafted message with an oversized length value, it writes data beyond the allocated heap buffer boundaries, corrupting adjacent memory structures.

Attack Vector

The attack vector requires adjacent network access (same Layer 2 network segment) to the target ESXi host. The attacker must be able to reach port 427 (SLP service) on the ESXi management interface. The attack does not require authentication or user interaction, making it highly exploitable once network access is achieved.

The exploitation sequence typically involves:

1. Network reconnaissance to identify ESXi hosts with port 427 accessible
2. Sending specially crafted SLP packets designed to trigger the heap overflow
3. Leveraging heap corruption to gain control of execution flow
4. Achieving remote code execution with root privileges on the ESXi host

Since no verified code examples are available for this vulnerability, readers seeking technical exploitation details should refer to the Zero Day Initiative Advisory ZDI-21-250 or the Packet Storm Security Exploit documentation.

Detection Methods for CVE-2021-21974

Indicators of Compromise

• Unusual network traffic to port 427 (UDP/TCP) on ESXi hosts from unauthorized sources
• Unexpected crashes or restarts of the SLP service (slpd) on ESXi hosts
• Evidence of unauthorized process execution or shell access on ESXi systems
• Anomalous outbound connections from ESXi management interfaces

Detection Strategies

• Monitor network traffic for suspicious SLP protocol activity on port 427, particularly malformed or oversized packets
• Deploy network intrusion detection systems (IDS) with signatures for CVE-2021-21974 exploitation attempts
• Review ESXi system logs (/var/log/) for evidence of service crashes or unexpected authentication events
• Implement network segmentation monitoring to detect unauthorized access to ESXi management networks

Monitoring Recommendations

• Enable logging and alerting for all traffic to ESXi management interfaces, especially port 427
• Configure SIEM solutions to correlate SLP-related events with potential indicators of compromise
• Perform regular vulnerability scanning of ESXi hosts to identify unpatched systems
• Monitor for unusual process activity or file system changes on ESXi hosts

How to Mitigate CVE-2021-21974

Immediate Actions Required

• Apply the VMware security patches immediately: ESXi 7.0 Update 1c, ESXi 6.7 ESXi670-202102401-SG, or ESXi 6.5 ESXi650-202102101-SG
• Disable the OpenSLP service on ESXi hosts if not required for operations
• Restrict network access to port 427 using firewall rules to allow only trusted management systems
• Isolate ESXi management networks from general user networks

Patch Information

VMware has released security patches addressing this vulnerability. Organizations should update to the following minimum versions:

• ESXi 7.0: Update to ESXi70U1c-17325551 or later
• ESXi 6.7: Apply patch ESXi670-202102401-SG or later
• ESXi 6.5: Apply patch ESXi650-202102101-SG or later
• Cloud Foundation: Update to the latest version per VMware Security Advisory VMSA-2021-0002

Workarounds

• Disable the SLP service on ESXi hosts using the ESXi shell or vSphere CLI if the service is not required
• Implement network-level controls to block access to port 427 from untrusted network segments
• Use vSphere firewall rules to restrict SLP service access to authorized management systems only

# Disable SLP service on ESXi via SSH
/etc/init.d/slpd stop
esxcli network firewall ruleset set -r CIMSLP -e false
chkconfig slpd off

# Verify SLP service is disabled
esxcli network firewall ruleset list | grep -i slp