CVE-2021-38648

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-38648
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-38648.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-38648
Published
2021-09-15T12:15:15Z
Modified
2026-08-12T12:49:04Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Open Management Infrastructure Elevation of Privilege Vulnerability

References

Affected packages

Git / github.com/microsoft/omi

Affected ranges

Type
GIT
Repo
https://github.com/microsoft/omi
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
4ce2cf1cb0aa656b8eb934c5acc3f4d6a6796bfa
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.6.8-1"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

v1.*
v1.0.8-6
v1.1.0-0
v1.2.0-35
v1.3.0-2
v1.4.0-6
v1.4.1-0
v1.4.2-1
v1.4.3
v1.4.3-1
v1.4.3-2
v1.4.4
v1.5.0
v1.6.0
v1.6.1-0
v1.6.2
v1.6.4-0
v1.6.4-1
v1.6.5-0
v1.6.6-0
v1.6.7-0
v1.6.8-0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-38648.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "162269167150493627019868074985816432074",
            "length": 683
        },
        "id": "CVE-2021-38648-008dc9db",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/microsoft/omi/commit/4ce2cf1cb0aa656b8eb934c5acc3f4d6a6796bfa",
        "target": {
            "file": "Unix/protocol/protocol.c",
            "function": "_SendAuthResponse"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "204635758016740555691592169614497387230",
            "length": 251
        },
        "id": "CVE-2021-38648-047d8965",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/microsoft/omi/commit/4ce2cf1cb0aa656b8eb934c5acc3f4d6a6796bfa",
        "target": {
            "file": "Unix/protocol/protocol.c",
            "function": "_ProcessPamCheckUserResp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "169557280295892769181980650258891294425",
            "length": 4691
        },
        "id": "CVE-2021-38648-14bd1a50",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/microsoft/omi/commit/4ce2cf1cb0aa656b8eb934c5acc3f4d6a6796bfa",
        "target": {
            "file": "Unix/protocol/protocol.c",
            "function": "_ProcessReceivedMessage"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "271504739194610036912456540681657099016",
                "7545253100261969648869691153228239956",
                "18749941215262244619080600396852797423",
                "56333546979381004515515984699084014745"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2021-38648-4918fb3f",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/microsoft/omi/commit/4ce2cf1cb0aa656b8eb934c5acc3f4d6a6796bfa",
        "target": {
            "file": "Unix/protocol/protocol.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "313478985022960783998607078190212228863",
                "57969247623981849610141542759926360411",
                "217588714389626790431612447810701179904",
                "39026852154188567098167050589066320112",
                "50966576885803475655801655947146908979",
                "136166596448859572456408461614759428659",
                "183475779225641489091563761442140417491",
                "128954801053471488760728251397366923246",
                "132531806083595378359829970724373567687",
                "53756027968303480859893459929943042778",
                "123783109968565460252064851143837875959",
                "184420845802076278254763431351584720451",
                "286205271014569967337837796246908674767",
                "132241595198362635920481141421444144216",
                "274786380004146169532966425274876993673",
                "333011583113295827548457629621961380469",
                "66464848382178122739145849880109351942",
                "49877124399746273976085696026845270797",
                "93797514026975715900380143724277598856",
                "258964993438979166948181038948227071375",
                "36579264777977680534724787780513078127",
                "298635416699266838046376522332014434839",
                "105662031857361035932714861581601667076",
                "328323365734905985533283378936764308577",
                "267775036139631174536787985745433294223",
                "293236273411620360308185500978081569456",
                "216196089554235834840665665268174676217",
                "209345085608318802578054215568299155168",
                "170301252088199076495860037051803100996",
                "134194152393844963720368669086155990929",
                "43836399923194085582164571433879668353",
                "312069200174573783827568758465524661050",
                "21856253596649868638899641370891348698",
                "250474744079484232155283441867418945554",
                "172315969730322809389308739008010193697",
                "79942335291732112595972693966501394590",
                "211859185001052913059792306903156523858",
                "119500795106670249669219466438795519038",
                "28290356734140469895429018797835034761",
                "240641726339560112096200045445653307833",
                "299796795839945206582999338607468179532",
                "335154310831801032247077443248291488636",
                "258035644103300679663529745973955799883",
                "246845013559698998459060891333058615662",
                "135358043026194842601967742764561355346",
                "315901980636351255820710333105599381469",
                "205306443741153889680235043948879792886",
                "322738528698335177996956666918130389558",
                "189284347993996343177288867126652562783",
                "161622743530130640580521135648642925063",
                "287878057601575856605319419469013961865",
                "233289512689744619701694609609248792523",
                "175477176395359491353726553919169400645",
                "297771449193960493175925764875282116454"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2021-38648-4ae90237",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/microsoft/omi/commit/4ce2cf1cb0aa656b8eb934c5acc3f4d6a6796bfa",
        "target": {
            "file": "Unix/protocol/protocol.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "217807718335855511173167369860693968085",
            "length": 1352
        },
        "id": "CVE-2021-38648-796fada3",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/microsoft/omi/commit/4ce2cf1cb0aa656b8eb934c5acc3f4d6a6796bfa",
        "target": {
            "file": "Unix/http/http.c",
            "function": "_ReadData"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "150795980792063409829254987312298558964",
                "309423053717453483883350037764534060769",
                "210909975569223455253145291958639656032",
                "132540073040509447664874737883846916201",
                "229848712763039069166164158394836256409",
                "169076288507285026684220341090382912047",
                "329706401746336992265374527597190091740",
                "181044309690113296558382129543936712292"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2021-38648-a678af21",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/microsoft/omi/commit/4ce2cf1cb0aa656b8eb934c5acc3f4d6a6796bfa",
        "target": {
            "file": "Unix/base/messages.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "240472139541574427730039340495232397709",
                "162238948086719740422868850233350431309",
                "191177854154940308246377898641983548755",
                "120264513683746604946344778289651352855",
                "235350525878720241130038663703492806313",
                "35627453137798835916403760933406839821",
                "214593626652284039539955812671710912099",
                "186621145619910950442101441460434202646",
                "252404082664294932253856016853288619206",
                "59770835291818304359508703325260838958",
                "333268902988043488216187062040961502963",
                "2622613298009947629415295550852133191",
                "127105711289893577177299030882678001702",
                "273245533570510245269111473084485499874"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2021-38648-b395d74d",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/microsoft/omi/commit/4ce2cf1cb0aa656b8eb934c5acc3f4d6a6796bfa",
        "target": {
            "file": "Unix/http/http.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "302310494828131017249385248010929507437",
            "length": 684
        },
        "id": "CVE-2021-38648-ba2b4990",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/microsoft/omi/commit/4ce2cf1cb0aa656b8eb934c5acc3f4d6a6796bfa",
        "target": {
            "file": "Unix/protocol/protocol.c",
            "function": "_ProcessEngineAuthMessage"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "295606304598442471339875506516320182025",
                "264812748718461868217329534450167935139",
                "38407438064275725354396280214349642539",
                "258407806404365935575669278129750918374",
                "205887140819293442653645260115666800101",
                "115761349100072574774724665024845769226",
                "190747748423295394382846834087053157474",
                "250322166377036499447447479690023448703"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2021-38648-bf5683a0",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/microsoft/omi/commit/4ce2cf1cb0aa656b8eb934c5acc3f4d6a6796bfa",
        "target": {
            "file": "Unix/base/oi_traces.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "278286501108309257571086796137303066484",
                "288335166381186519040267779851586726302",
                "114152311915264464753512738433121510211",
                "117973431420040281181646799051033643521",
                "298570151840893485885703010964006145932",
                "92218430094717642517060102256091907695",
                "159183756350937071696392440434600785411",
                "56158036290459295273660149486966862824",
                "30323749058569641293525612559933284111",
                "331089204115371168867079797785835738663",
                "251070051575679177357137350771500029606",
                "229367395486230179703111173636023808928",
                "306455205132604001308655494002133954417",
                "41687164953781364918710937590439767170",
                "693785887311512335633195606107881827",
                "104463172333958615848702053383796128010",
                "56017407325313781661504247385380054043",
                "92739033925654516913580072068399732294",
                "33057915557976494724630895784453966855"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2021-38648-c410f7ab",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/microsoft/omi/commit/4ce2cf1cb0aa656b8eb934c5acc3f4d6a6796bfa",
        "target": {
            "file": "Unix/base/oiomi.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "168640275114321711282903853964064538914",
            "length": 406
        },
        "id": "CVE-2021-38648-e0f8a5aa",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/microsoft/omi/commit/4ce2cf1cb0aa656b8eb934c5acc3f4d6a6796bfa",
        "target": {
            "file": "Unix/protocol/protocol.c",
            "function": "_SendPamCheckUserResp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "184786336945294264915468788765593170439",
            "length": 1509
        },
        "id": "CVE-2021-38648-e7e31dd7",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/microsoft/omi/commit/4ce2cf1cb0aa656b8eb934c5acc3f4d6a6796bfa",
        "target": {
            "file": "Unix/protocol/protocol.c",
            "function": "_ProtocolSocketAndBase_New_Server_Connection"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "226215268751094784097136930394965618465",
                "125143438896525945100869535990019004473",
                "133129748656127201049385816899836917924",
                "245632929136374031583091323210163604719",
                "243918690856398902723527312371840795540",
                "84439803892864407962921709368824231454",
                "262716688038302620868524373398115696279",
                "45317830273252908080144161506675002402",
                "134772859427918796215638732171719570109",
                "234412281792303765123247229351031648018",
                "155919802974878733853288555674367362269"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2021-38648-ea25c156",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/microsoft/omi/commit/4ce2cf1cb0aa656b8eb934c5acc3f4d6a6796bfa",
        "target": {
            "file": "Unix/base/messages.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "212016841445380398532777469409925560413",
            "length": 810
        },
        "id": "CVE-2021-38648-ee12c829",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/microsoft/omi/commit/4ce2cf1cb0aa656b8eb934c5acc3f4d6a6796bfa",
        "target": {
            "file": "Unix/protocol/protocol.c",
            "function": "_ProtocolSocket_Cleanup"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "237789250194070545612992539917616677583",
            "length": 2672
        },
        "id": "CVE-2021-38648-f5b82bb4",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/microsoft/omi/commit/4ce2cf1cb0aa656b8eb934c5acc3f4d6a6796bfa",
        "target": {
            "file": "Unix/http/http.c",
            "function": "_ListenerCallback"
        }
    }
]
vanir_signatures_modified 
"2026-08-12T12:49:04Z"