ESXi OpenSLP Heap Overflow (ESXiArgs)

aka ESXiArgs

Product: VMware ESXi (OpenSLP)
CVE: CVE-2021-21974
Disclosed: 2021-02-23
CVSS: 8.8
Auth: pre-auth
CISA KEV: no
Affected: ESXi 7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5 before ESXi650-202102101-SG.
Fixed: Patches in VMSA-2021-0002.

Summary

A heap overflow in the OpenSLP service bundled with ESXi. Two years after the patch, the February 2023 ESXiArgs ransomware campaign hit thousands of unpatched internet-facing ESXi hosts, and this bug was widely reported as the entry point.

Root cause

The SLP daemon (slpd, port 427) in VMware's fork of OpenSLP copies a network-supplied service URL without first NUL-terminating it; a strstr() over the unterminated buffer reads out of bounds and the following memcpy overflows the heap. VMware had not merged the upstream OpenSLP fix. slpd runs as root, so this gives root code execution.

Impact

Remote root code execution on ESXi from an attacker with network access to port 427, followed by encryption of VM disks.

Public PoC

# ESXi shell: stop SLP and block it in the firewall
/etc/init.d/slpd stop
esxcli network firewall ruleset set -r CIMSLP -e 0

# persist across reboots and verify
chkconfig slpd off
chkconfig --list | grep slpd   # expect: slpd off
esxcli system slp stats get

Source: Broadcom KB 318790 (VMware KB76372) - How to Disable/Enable the SLP Service on ESXi

Detection

Scan for exposed TCP/UDP 427 and check ESXi build numbers. ESXiArgs left .args files and ransom notes in /vmfs/volumes and modified index.html.

Mitigation

Patch, and disable SLP if unused: /etc/init.d/slpd stop; esxcli network firewall ruleset set -r CIMSLP -e 0; chkconfig slpd off (VMware KB76372 / Broadcom 318790).