CVE-2021-38645: Azure Automation Privilege Escalation

CVE-2021-38645 Overview

CVE-2021-38645 is an elevation of privilege vulnerability affecting Microsoft's Open Management Infrastructure (OMI), a critical component used across multiple Azure services for Linux-based systems management. This vulnerability allows authenticated local attackers to escalate their privileges on affected systems, potentially gaining root-level access to compromised Azure virtual machines and hybrid cloud infrastructure.

The vulnerability is part of a broader set of OMI flaws disclosed in September 2021 that collectively became known as "OMIGOD." This particular vulnerability requires local access but enables attackers with low privileges to achieve complete system compromise on affected Azure resources.

Critical Impact

This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. Attackers can leverage this flaw to escalate privileges and gain complete control over Azure Linux VMs and hybrid infrastructure components.

Affected Products

• Microsoft Azure Automation State Configuration
• Microsoft Azure Automation Update Management
• Microsoft Azure Diagnostics (LAD)
• Microsoft Azure Open Management Infrastructure
• Microsoft Azure Security Center
• Microsoft Azure Sentinel
• Microsoft Azure Stack Hub
• Microsoft Container Monitoring Solution
• Microsoft Log Analytics Agent
• Microsoft System Center Operations Manager

Discovery Timeline

• September 15, 2021 - CVE-2021-38645 published to NVD
• October 30, 2025 - Last updated in NVD database

Technical Details for CVE-2021-38645

Vulnerability Analysis

This elevation of privilege vulnerability exists within the Open Management Infrastructure (OMI) agent, which is automatically installed on Linux systems when customers enable certain Azure services. The vulnerability allows a local attacker who already has limited access to a target system to escalate their privileges to root, effectively gaining complete administrative control.

The OMI agent runs as a privileged service to perform management operations on behalf of Azure services. Due to improper access controls within the OMI framework, local users can exploit this weakness to execute operations with elevated privileges that should be restricted to administrative accounts only.

What makes this vulnerability particularly concerning is its broad attack surface across the Azure ecosystem. The OMI agent is silently deployed as a dependency for numerous Azure services, meaning many organizations may have vulnerable systems without realizing OMI is present. Combined with the local attack vector, this vulnerability is especially dangerous in multi-tenant environments or scenarios where an attacker has already achieved initial access through other means.

Root Cause

The root cause of CVE-2021-38645 lies in improper privilege management within the OMI framework. The vulnerability stems from insufficient validation and access control mechanisms when processing requests from local users. The OMI service, which runs with elevated privileges to perform management tasks, fails to properly authenticate and authorize operations initiated by local processes, allowing unprivileged users to perform actions reserved for administrative accounts.

Attack Vector

This vulnerability requires local access to exploit, meaning an attacker must first establish a foothold on the target system. The attack can be executed by any authenticated user on the system, regardless of their privilege level. The exploitation flow typically involves:

1. Attacker gains initial access to an Azure Linux VM through legitimate credentials, compromised accounts, or via another vulnerability
2. Attacker identifies the presence of the vulnerable OMI agent on the system
3. Attacker crafts malicious requests to the OMI service that exploit the privilege escalation flaw
4. The OMI service processes these requests with its elevated privileges, executing attacker-controlled operations as root
5. Attacker achieves full root-level access to the compromised system

The vulnerability can be chained with other OMIGOD vulnerabilities (such as the remote code execution variant CVE-2021-38647) to achieve complete compromise of Azure infrastructure from an initial network position.

Detection Methods for CVE-2021-38645

Indicators of Compromise

• Unexpected privilege escalation events originating from OMI-related processes (omiserver, omiagent, omicli)
• Anomalous process creation with elevated privileges linked to OMI service execution
• Suspicious authentication or authorization failures in OMI logs followed by successful privileged operations
• Creation of new administrative accounts or modification of existing account privileges after OMI interaction

Detection Strategies

• Monitor for unusual process hierarchies where low-privileged user processes spawn root-level child processes through OMI components
• Implement file integrity monitoring on OMI binaries and configuration files located in /opt/omi/
• Audit system calls and capability changes associated with OMI service processes
• Deploy behavioral detection for privilege escalation patterns on Linux endpoints with OMI installed

Monitoring Recommendations

• Enable detailed logging for OMI services and forward logs to centralized SIEM solutions
• Configure alerts for any modifications to critical system files following OMI service activity
• Implement endpoint detection and response (EDR) monitoring on all Azure Linux VMs with OMI components
• Regularly audit installed OMI versions across your Azure environment using Azure Resource Graph queries

How to Mitigate CVE-2021-38645

Immediate Actions Required

• Identify all Azure resources with OMI installed by auditing Azure VM extensions and installed packages
• Apply the Microsoft security update for OMI immediately to all affected systems
• Review system logs for any indicators of exploitation that may have occurred prior to patching
• Implement network segmentation to limit lateral movement potential from potentially compromised systems

Patch Information

Microsoft has released security updates to address this vulnerability. Organizations should update OMI to the latest patched version by applying the relevant Azure updates or manually updating the OMI package on affected Linux systems.

For detailed patch guidance, refer to the Microsoft Security Advisory for CVE-2021-38645.

Additionally, this vulnerability is tracked in the CISA Known Exploited Vulnerabilities Catalog, which mandates federal agencies to apply mitigations within specified deadlines.

Workarounds

• Restrict local access to Azure VMs by implementing strict access controls and just-in-time (JIT) VM access
• Disable unnecessary Azure extensions that deploy OMI if the functionality is not required
• Implement the principle of least privilege for all users with access to Azure Linux resources
• Consider temporarily blocking or restricting OMI service ports (TCP 5985/5986) while patches are being deployed

# Check installed OMI version
/opt/omi/bin/omiserver --version

# Verify OMI service status
systemctl status omid

# Update OMI package on Ubuntu/Debian
sudo apt-get update && sudo apt-get install --only-upgrade omi

# Update OMI package on RHEL/CentOS
sudo yum update omi