VMware ESXi (OpenSLP): OpenSLP heap overflow - the ESXiArgs ransomware entry point that mass-encrypted thousands

Impact

OpenSLP heap overflow - the ESXiArgs ransomware entry point that mass-encrypted thousands of hosts [KEV]

Who can reach it

Unauthenticated network on the same segment

What to do

Patch + disable SLP. The canonical example of why the hypervisor management plane must never share a broadcast domain with tenants

References

Related entries

• VMware ESXi (OpenSLP): Use-after-free in OpenSLP on port 427 - unauthenticated remote code execution on the hypervisorCVE-2020-3992 · VMware ESXi (OpenSLP)Critical
• Linux KVM x86 - stack out-of-bounds in ioapic_write_indirect(): A guest write to the virtual IOAPIC causes a stackCVE-2021-47390 · Linux KVM x86 - stack out-of-bounds in ioapic_write_indirect()High
• Xen (xenstored): Guest can crash xenstored, taking down control-plane services for all guests on the hostCVE-2022-42309 · Xen (xenstored)High
• Linux kernel drivers/vdpa/mlx5 (mlx5 vDPA net device): A guest with an assigned mlx5 vDPA net device sends anCVE-2022-48864 · Linux kernel drivers/vdpa/mlx5 (mlx5 vDPA net device)High
• Intel CPU (Reptar): Redundant REX-prefix MOVSB causes unpredictable behaviourCVE-2023-23583 · Intel CPU (Reptar)High
• Intel i915 graphics driver for Linux (kernel < 6.2.10): A memory-buffer bounds failure in the i915 kernel driver thatCVE-2023-28410 · Intel i915 graphics driver for Linux (kernel < 6.2.10)High