An attacker can exploit this vulnerability by sending a malicious packet to the affected system, triggering the overflow and allowing the attacker to execute arbitrary code. The vulnerability is caused by a heap overflow in the OpenSLP service that is present in ESXi.

This combined with the fact that we reported last September that nearly 60% of ESXi servers were running one of the end-of-life versions, means that there is a rather large chance organizations are using outdated versions.ĬVE-2021-21974 is a heap-overflow vulnerability in VMware ESXi. While there isn't any concrete proof that this vulnerability is the exact vulnerability being abused, there is proof that the attack use some sort of vulnerability in OpenSLP. In addition to these findings, OVHcloud also mentioned that link to the Nevada ransomware seemed to be unfounded, over the weekend, the new strain of has been dubbed ESXiArgs. The malware creates argsfile to store arguments passed to the encrypt binary (number of MB to skip, number of MB in encryption block, file size).This function is not systematically working as expected resulting in files remaining locked. The malware tries to shut down virtual machines by killing the VMX process to unlock the files.The encryption process is specifically targeting virtual machines files ('.Encryption is using a public key deployed by the malware in /tmp/public.pem.

The logs actually show the user dcui as involved in the attack process.

The point of compromise is confirmed to be an OpenSLP vulnerability that might be CVE-2021-21974 (still to be confirmed).This vulnerability affects the Service Location Protocol (SLP) service and allows an attacker to remotely exploit arbitrary code.'įrench cloud services provider OVHcloud later released the following observations on : On February 3, 2023, the French National Computer Emergency Response Team (CERT) released a security advisory covering the ESXiArgs ransomware mentioning that 'attack campaigns seem to exploit the CVE-2021-21974 vulnerability, for which a patch has been available since February 23, 2021. ⚡ TL DR | Go Straight to the ESXi Version Audit

Servicenow lansweeper integration