Skip to content
OpenAdvisories
High MSRC-CVE-2024-21330 1 CVE

Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability

Published Mar 12, 2024 · Updated Apr 9, 2024 · Revision 2

Vendor: Microsoft

Summary

Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

What privileges could be gained by an attacker who successfully exploited this vulnerability?
Successful exploitation of this vulnerability will locally elevate the attacker's privileges to communicate as Root with OMI server.

According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker be an authenticated user on the resource to access the necessary socket files to control the OMI service.

What actions do I need to take to be protected from this vulnerability?
Customers running affected versions of SCOM (System Center Operations Manager) should update to OMI version 1.8.1-0.

What is OMI?
Open Management Infrastructure (OMI) is an open-source Web-Based Enterprise Management (WBEM) implementation for managing Linux and UNIX systems. SCOM uses this framework to orchestrate configuration management and log collection on Linux VMs.
More information can be found here: GitHub - Open Management Infrastructure.

What products are affected by this vulnerability and how can I protect myself?
The following table lists the affected services and the required customer action to protect against this vulnerability.
OMI as standalone package: OMI as standalone package, OMI version v1.8.1-0: OMI version v1.8.1-0, Manually download the update here: Manually download the update here, System Center Operations Manager (SCOM) Management Pack for UNIX and Linux Operating Systems: System Center Operations Manager (SCOM) Management Pack for UNIX and Linux Operating Systems, Management Pack for SCOM 2019: 10.19.1253.0: Management Pack for SCOM 2019: 10.19.1253.0, Manually download and update the applicable management packs:  2019, or 2022.: Manually download and update the applicable management packs:  2019, or 2022., : , Management Pack for SCOM 2022: 10.22.1070.0: Management Pack for SCOM 2022: 10.22.1070.0, : , Log Analytics Agent: Log Analytics Agent, OMS Agent for Linux GA v1.19.0: OMS Agent for Linux GA v1.19.0, Manually download and update the OMS shell bundle using instructions here OR through Azure Powershell or Azure CLI using the instructions here.: Manually download and update the OMS shell bundle using instructions here OR through Azure Powershell or Azure CLI using the instructions here., Azure Security Center: Azure Security Center, OMS Agent for Linux GA v1.19.0: OMS Agent for Linux GA v1.19.0, Manually download and update the OMS shell bundle using instructions here OR through Azure Powershell or Azure CLI using the instructions here.: Manually download and update the OMS shell bundle using instructions here OR through Azure Powershell or Azure CLI using the instructions here., Container Monitoring Solution: Container Monitoring Solution, Image tag: microsoft-oms-latest with full ID: sha256:855bfeb0599e1e1d954ab8660808cc24bb190a4447818cd3fa8ad89bdad88df4: Image tag: microsoft-oms-latest with full ID: sha256:855bfeb0599e1e1d954ab8660808cc24bb190a4447818cd3fa8ad89bdad88df4, Manually update the OMS-docker image using instructions here.: Manually update the OMS-docker image using instructions here., Azure Sentinel: Azure Sentinel, OMS Agent for Linux GA v1.19.0: OMS Agent for Linux GA v1.19.0, Manually download and update the OMS shell bundle using instructions here OR through Azure Powershell or Azure CLI using the instructions here.: Manually download and update the OMS shell bundle using instructions here OR through Azure Powershell or Azure CLI using the instructions here., Azure Automation: Azure Automation, OMS Agent for Linux GA v1.19.0: OMS Agent for Linux GA v1.19.0, Manually download and update the OMS shell bundle using instructions here OR through Azure Powershell or Azure CLI using the instructions here.: Manually download and update the OMS shell bundle using instructions here OR through Azure Powershell or Azure CLI using the instructions here., Azure Automation Update Management: Azure Automation Update Management, OMS Agent for Linux GA v1.19.0: OMS Agent for Linux GA v1.19.0, Manually download and update the OMS shell bundle using instructions here OR through Azure Powershell or Azure CLI using the instructions here.: Manually download and update the OMS shell bundle using instructions here OR through Azure Powershell or Azure CLI using the instructions here.

Security updates
10.19.1253.0 — https://www.microsoft.com/en-us/download/details.aspx?id=58208
10.22.1070.0 — https://www.microsoft.com/en-in/download/details.aspx?id=104213
OMS Agent for Linux GA 1.19.0 — https://docs.microsoft.com/en-us/azure/virtual-machines/extensions/oms-linux#azure-cli-deployment
microsoft-oms-latest with full ID — https://github.com/microsoft/containerregistry
omi-1.8.1-0 — https://learn.microsoft.com/en-us/azure/hdinsight/hdinsight-release-notes
OMI version 1.8.1-0 — https://github.com/microsoft/omi
1.8.1-0 — https://github.com/microsoft/OMS-Agent-for-Linux
OMS Agent for Linux GA v1.19.0 — https://docs.microsoft.com/en-us/azure/virtual-machines/extensions/dsc-overview#azure-cli-deployment

Vulnerabilities 1

Revision history

  1. #2

    In the Security Updates table, added Azure HDInsights because this product is also affected by this vulnerability. Microsoft strongly recommends that customers running Azure HDInsights install the updates to be fully protected from the vulnerability.

  2. #1

    Information published.

References