Headline
CVE-2023-29552: VMware Response to CVE-2023-29552 - Reflective Denial-of-Service (DoS) Amplification Vulnerability in SLP
The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use spoofed UDP traffic to conduct a denial-of-service attack with a significant amplification factor.
Greetings from the VMware Security Response Center!
Today we wanted to address CVE-2023-29552 – a vulnerability in SLP that could allow for a reflective denial-of-service amplification attack that was disclosed on April 25th, 2023.
VMware has investigated this vulnerability and determined that currently supported ESXi releases (ESXi 7.x and 8.x lines) are not impacted.
However, releases that have reached end of general support (EOGS) such as 6.7 and 6.5 have been found to be impacted by CVE-2023-29552. As per previous guidance and best practice VMware recommends that the best option to address CVE-2023-29552 is to upgrade to a supported release line that is not impacted by the vulnerability. ESXi 7.0 U2c and newer, and ESXi 8.0 GA and newer, ship with the SLP service hardened, disabled by default, and filtered by the ESXi firewall. In lieu of an upgrade to a supported release, ESXi admins should ensure that their ESXi hosts are not exposed to untrusted networks and also disable SLP following the instructions in KB76372.
VMware would like to thank Bitsight and CISA for reporting this vulnerability to us.
Related news
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a high-severity flaw in the Service Location Protocol (SLP) to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. Tracked as CVE-2023-29552 (CVSS score: 7.5), the issue relates to a denial-of-service (DoS) vulnerability that could be weaponized to launch massive DoS
Details have emerged about a high-severity security vulnerability impacting Service Location Protocol (SLP) that could be weaponized to launch volumetric denial-of-service attacks against targets. "Attackers exploiting this vulnerability could leverage vulnerable instances to launch massive Denial-of-Service (DoS) amplification attacks with a factor as high as 2200 times, potentially making it