OMI Vulnerability Let Attackers Predict a Secret and Escalate to Root
Summary
Wiz researchers explain how CVE-2022-29149 let attackers predict OMI’s time-seeded secretString, forge privileged messages, and escalate to root. OMI versions before 1.6.9-1 are affected; Microsoft recommends updating.
Key points
- CVE-2022-29149 affects OMI versions earlier than 1.6.9-1 and enables local privilege escalation.
- OMI generates secretString using the current system time as the random-number seed; knowing when the process launched can allow the value to be predicted.
- Researchers say the recovered secretString can be used to forge messages from OMI’s highly privileged process and bypass a previous patch, enabling root access.
- OMI may be installed with Azure services on Linux VMs, sometimes without customers’ awareness; several listed Azure services do not support automatic updates and may remain vulnerable until updated.
- Microsoft’s patched OMI version is 1.6.9-1. Customers can check installed versions with dpkg or rpm and update through the package manager.
- Microsoft added the OMS, LAD, and DSC agents to Automatic Extension Upgrade; the article recommends enabling it or migrating to Azure Monitoring Agent, which does not rely on OMI.
- Wiz reported detecting vulnerable workloads through its Threat Center on the day CVE-2022-29149 was announced.
Article Details
- Attack Vectors
- CVE-2022-29149 permits local privilege escalation in OMI; Wiz Research validated that it is exploitable.
- The vulnerability arises from OMI's use of a system-time-seeded pseudo-random secretString. An attacker who can determine when the OMI process launched can recover the secret and forge messages that appear to originate from the highly privileged OMI process.
- The recovered secretString can be used to bypass the patch for CVE-2021-38645 and elevate privileges to root.
- Defensive Notes
- Update OMI to version 1.6.9-1 or later.
- Enable automatic updates for the OMS, LAD, and DSC agents, which bundle OMI, or migrate to Azure Monitoring Agent, which does not rely on OMI.
- For services without auto-updates, update OMI manually using the package manager. Check for installed OMI with dpkg -l omi on Debian-based systems or rpm -qa omi on Red Hat-based systems.
MITRE ATT&CK
CVE
CVE-2021-38645Apparently, we can use the recovered secretString to bypass the patch Microsoft introduced to address CVE-2021-38645 (one of the LPE vulnerabilities we disclosed in June 2021) and elevate our privileges to root.CVE-2021-38647in June 2021, including an unauthenticated remote code execution vulnerability dubbed “OMIGOD” (CVE-2021-38647).CVE-2022-29149June 2022 Patch Tuesday, Microsoft published a patch to fix a new privilege escalation vulnerability, CVE-2022-29149 in Open Management Infrastructure (OMI), with a CVSS score of 7.8 (the highest score possible for
Vendors
Products
Azurefor vulnerabilities that allow local privilege escalation). OMI is cloud middleware software used by Azure, typically installed on Linux VMs without explicit customer notification, like most other cloud agents.Azure Monitoring Agentto enable automatic updates for the OMS, LAD and DSC agents and encourage customers to migrate to Azure Monitoring Agent which does not rely on OMI. Automatic Extension Upgrade will ensure that Azure customers get anyAzure Open Management Infrastructure (OMI)a patch to fix a new privilege escalation vulnerability, CVE-2022-29149 in Open Management Infrastructure (OMI), with a CVSS score of 7.8 (the highest score possible for vulnerabilities that allow local privilegeOMSOMI is installed automatically by multiple popular Azure services usually as part of the OMS agent (Operations Management Suite). While it is documented by Microsoft, customers may still not be aware of its existence.