VMware Avi Load Balancer: local user can escalate to root on the appliance

Impact

A user who already holds a shell on an Avi Controller or Service Engine can run code as root on that appliance. Avi commonly fronts the API and inference endpoints in front of an accelerator fleet and holds the TLS keys and backend pool configuration for them, so root on the controller means the ability to intercept or redirect traffic for every service it publishes, and to change pool membership without touching the fleet itself. The advisory gives no detail on the mechanism beyond local access, so the first practical control is auditing who has appliance shell accounts at all.

Who can reach it

Local user with an existing low-privilege account on the Avi Controller or Service Engine. Authentication required; no network-reachable path stated in the advisory.

What to do

Upgrade per the Broadcom advisory: 32.1.1 to 32.1.2; 31.1.1 through 31.2.2 to 31.2.2-2p3; 30.1.1 through 30.2.6 to 30.2.7; 22.1.1 through 22.1.7 to 30.2.7. This is an appliance upgrade with a controller and Service Engine restart, so plan a traffic-drain window for the SEs rather than treating it as a package bump.

References