High‑Severity Privilege Escalation in Microsoft Open Management Infrastructure (OMI) (CVE‑2021‑38645)
What It Is
Microsoft Open Management Infrastructure (OMI), a component of Azure VM Management Extensions, contains an unspecified flaw that permits a local attacker to elevate privileges to the highest system level (SYSTEM on Windows, root on Linux). The vulnerability is cataloged as CVE‑2021‑38645 and carries a CVSS v3.1 base score of 7.8 (HIGH).
Exploitability
- No public evidence of active exploitation in the wild.
- Proof‑of‑concept code has been released by independent researchers, confirming the feasibility of privilege escalation on affected hosts.
- Microsoft has issued a security update that mitigates the issue; applying the patch removes the attack vector.
Affected Products
- Microsoft Open Management Infrastructure (OMI) versions prior to the security update (included in Azure VM Management Extensions).
- Linux virtual machines hosted on Azure that rely on OMI for management operations.
Why It Matters for Compliance & Audit Readiness
Privilege‑escalation flaws directly challenge access control and least‑privilege principles required by frameworks such as NIST CSF, ISO 27001, and PCI‑DSS. Demonstrating that privileged components are patched and continuously monitored satisfies audit expectations for:
- Vendor‑management controls – evidence that third‑party components (Azure extensions) are kept current.
- Access‑control assurance – proof that elevated‑privilege pathways are closed, supporting a defensible control‑mapping artifact.
- Continuous monitoring – logs of OMI activity can be incorporated into a SOC or CM‑monitoring feed, providing real‑time evidence of control effectiveness.
Recommended Actions
- Patch immediately – Deploy Microsoft’s OMI security update (KB 5008602 or later) to all Azure‑hosted Linux VMs.
- Validate versions – Inventory OMI versions via Azure Policy or configuration management tools; confirm remediation status.
- Enable telemetry – Activate OMI audit logging and forward events to a SIEM for anomaly detection.
- Document remediation – Record patch deployment dates, version snapshots, and monitoring configurations to create a defensible audit trail.
- Review access‑control policies – Re‑affirm that only authorized service accounts can invoke OMI functions, aligning with least‑privilege mandates.
Source: https://nvd.nist.gov/vuln/detail/CVE-2021-38645