Skip to content
OpenAdvisories
High MSRC-CVE-2024-21329 1 CVE

Azure Connected Machine Agent Elevation of Privilege Vulnerability

Published Feb 13, 2024 · Updated Mar 20, 2024 · Revision 3

Vendor: Microsoft

Summary

Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

Why is the update for Azure Connected Machine Agents unavailable?
The update was removed from the Microsoft Update Catalog due to reports of installation failing. The update will be re-released when the issue is resolved, and this CVE will be updated at that time.

According to the CVSS metric, user interaction is required (UI:R) and privileges required is Low (PR:L). What does that mean for this vulnerability?
A non-admin local user who has sufficient permissions to create symbolic links on a Windows computer that has Azure Connected Machine Agent installed (or before the agent is installed) could create links from a directory used by the agent to other privileged files on the computer. If the administrator later installs virtual machine extensions on the machine, those files could be deleted.

What privileges could an attacker gain with successful exploitation?
An attacker who successfully exploited the vulnerability could add symlinks and cause an arbitrary file delete as SYSTEM.

Security updates
1.38 — https://learn.microsoft.com/en-us/azure/azure-arc/servers/agent-release-notes

Vulnerabilities 1

Revision history

  1. #3

    The security update 1.38 for Azure Connected Machine Agent is now available. See the Security Updates table for more information.

  2. #2

    In the Security Updates table, removed the Article and Download links because the update is not available for Azure Connected Machine Agent. Customers will be notified via a revision to this CVE information when the update becomes available.

  3. #1

    Information published.

References