vCenter Lost: How the DCERPC Vulnerabilities Changed the Fate of ESXi

vCenter Lost: How the DCERPC Vulnerabilities Changed the Fate of ESXi

Speakers: Zo, Security Researcher, Tianin Tangun lab

Conference: Black Hat Asia

YouTube: https://www.youtube.com/watch?v=GOXhztVXw4c

Overview

In a compelling presentation at Black Hat Asia 2025, Zo from Tianin Tangun lab unveiled critical research titled "vCenter Lost: How the DCERPC Vulnerabilities Changed the Fate of ESXi." This talk delved into a series of newly discovered vulnerabilities within VMware vCenter’s DCERPC (Distributed Computing Environment Remote Procedure Call) service, detailing how these flaws could be chained to achieve remote code execution (RCE) with root privileges and ultimately gain full control over the underlying ESXi host. The research, a collaborative effort with Hau Yu, highlights the profound security implications of vulnerabilities in foundational services within virtualized environments.

The presentation was particularly timely, following VMware's security advisory at the end of 2023 regarding a remote triggerable memory corruption issue in vCenter, which was reportedly exploited in the wild. This prior discovery spurred the Tianin Tangun lab team to conduct a deeper investigation, leading to the identification of four novel vulnerabilities. Two of these were successfully exploited to demonstrate RCE with root privileges, an achievement that earned them an award at the Matrix Cup competition. The comprehensive analysis presented offers crucial insights for both defenders and researchers into the complexities of securing virtualization management platforms.

This article provides a detailed technical breakdown of the vulnerabilities, the sophisticated exploitation techniques employed to bypass modern memory protections, the unique privilege escalation method, and the subsequent ESXi host compromise. It underscores the critical importance of robust security practices and continuous auditing of core services within enterprise infrastructure, especially those managing virtualized resources that are often considered the backbone of modern data centers.

Background

▶ Watch: Introduction to VCenter vulnerabilities and research context (0:00)

VMware vCenter Server is the centralized management utility for VMware vSphere environments, allowing administrators to manage virtual machines, hosts, and other vSphere components from a single interface. Given its critical role, vCenter is a high-value target for attackers, and any compromise can have far-reaching consequences across an entire virtualized infrastructure. The security of its underlying services is paramount.

The core of the presented research focuses on the DCERPC (Distributed Computing Environment Remote Procedure Call) protocol, a widely adopted remote procedure call system used in both Unix and Windows systems. DCERPC enables clients to invoke functions on a remote server as if they were local, facilitating inter-process communication across networks. In vCenter, the DCERPC library is loaded by several processes, including vmdcd and vmafd. The researchers specifically focused on the vmdrd process, which provides the DCERPC service on port 2012. This port is often accessible on all network interfaces, making it a prime target for remote attacks.

The impetus for this research stemmed from a VMware security advisory at the close of 2023, which disclosed a remote triggerable memory corruption vulnerability in vCenter. The fact that this vulnerability was being exploited in the wild underscored the urgent need for a deeper dive into vCenter’s DCERPC implementation. While the initial advisory pointed to an existing flaw, the Tianin Tangun lab team’s subsequent investigation uncovered a fresh set of vulnerabilities, demonstrating that even after public disclosures, critical components can harbor further, undiscovered weaknesses. Their work built upon prior research into VMware security, including hypervisor implementations, where they had previously identified and reported numerous vulnerabilities presented at conferences like DEF CON and HITB.

Key Findings

▶ Watch: Understanding DCERPC protocol and VCenter implementation details (2:50)

The research team uncovered four distinct vulnerabilities within the vmdrd process’s DCERPC implementation, two of which were successfully exploited to achieve RCE with root privileges, culminating in an ESXi host escape. These findings underscore the subtle yet critical flaws that can exist in complex network protocols and their parsing logic.

The four key vulnerabilities identified are:

1. CVE-2024-37079 & CVE-2024-37080: Heap Overflows during DCERPC Bind Response Generation. These two vulnerabilities manifest as heap overflows that occur during the server's generation of a DCERPC bind response packet. Specifically, they arise when the request packet contains authentication data, leading to an integer underflow in size calculations that bypasses length validation checks, allowing for an out-of-bounds write.
2. Heap Overflow during DCERPC Bind Request Processing. This vulnerability also presents as a heap overflow, but it occurs during the server's processing of an incoming DCERPC bind request packet. Attackers can manipulate the o_len (authentication data length) field and the absence of o_data to cause an incorrect pointer calculation and a subsequent integer underflow, leading to a large memcpy operation that overflows a heap buffer.
3. Heap Overflow with Arbitrary Relative Address Write during DCERPC Call Request Processing. This is a critical heap overflow occurring within the decoder for array type data in the NDR (Network Data Representation) format used for DCERPC call requests. The core flaw lies in the insufficient validation of lower and upper bounds for array elements, despite a check for upper - lower > z_value. This oversight enables an arbitrary relative address write, a highly potent primitive for exploitation, which the researchers successfully leveraged for RCE.
4. Privilege Escalation Vulnerability in vmdrd Initialization. This unique vulnerability allows for privilege escalation to root within the vmdrd process. It exploits a race condition or specific interaction related to how vmdrd binds to specific ports (specifically ports 636 and 389) and drops privileges. By preventing vmdrd from successfully binding these ports upon restart, the process fails to drop its root privileges, making it susceptible to a subsequent RCE attack with elevated permissions.

The successful exploitation chain demonstrated by the researchers involved leveraging the third heap overflow for RCE, followed by the fourth privilege escalation vulnerability to gain root, and finally, an ingenious method to escape vCenter and control the underlying ESXi host.

Technical Deep Dive

▶ Watch: Starting vulnerability discovery: CVE-2024-37079 and 37080 (4:10)

The technical core of this research revolves around exploiting intricate flaws in DCERPC packet parsing and memory management within the vmdrd process. The researchers meticulously analyzed the protocol, identified specific weaknesses, and devised sophisticated techniques to bypass modern memory protections.

Vulnerability 1: Heap Overflow in Bind Response Generation (CVE-2024-37079 & CVE-2024-37080)

This vulnerability occurs when the vmdrd server generates a bind response packet. If the client’s request includes authentication data, the server will incorporate an authentication response. The key parameters involved are header_size and n_context_elements. n_context_elements is derived directly from the client’s request, and while subject to four constraints during the parsing phase, it can reach a maximum value of 0xA9. This, in turn, allows header_size to reach 0xFFC.

The problem arises because the response packet buffer is allocated 0x1000 bytes. During the bind response generation, header_size is incremented by an additional 8 bytes, pushing its value beyond 0x1000. This leads to an integer underflow when header_size is later used in a calculation to determine n_ls (the remaining buffer space for output tokens). The underflow causes n_ls to become an extremely large value, effectively bypassing subsequent length validation checks. Consequently, when authentication data is written into the buffer, it overflows the allocated 0x1000-byte heap buffer.

Vulnerability 2: Heap Overflow in Bind Request Processing

This second heap overflow occurs during the server's processing of the incoming bind request packet. At the end of a bind request packet, an authentication trailer is present. The o_len field in the common header specifies the length of the authentication data. The o_trailer pointer is calculated by subtracting o_len and 8 bytes (for the trailer header) from the end of the packet.

A crucial check ensures o_trailer is within the packet and that o_trailer + o_len also remains within the packet. However, this check is flawed because it assumes o_len accurately reflects the actual length of the o_data. An attacker can set o_len to a small value (e.g., 1) but send no o_data. The check will still pass, but o_trailer will point into the common header. When o_len is later added to the header_size, the result exceeds the total size of the PDU (Protocol Data Unit). This again leads to an integer underflow when input_token_len is calculated, resulting in an extremely large value. Finally, a memcpy operation attempts to copy this massive amount of data into a heap buffer, triggering a heap overflow.

Vulnerability 3: Heap Overflow with Arbitrary Relative Address Write in Call Request (RCE Primitive)

This is the most critical vulnerability for achieving RCE. It resides in the handling of DCERPC call requests, which are more complex than bind packets. Call requests include an op_num (operation number) to determine the RPC function to execute, and stab_data which contains the input parameters encoded using NDR (Network Data Representation) format. NDR supports various data types, including arrays.

The vulnerability specifically targets the decoder for array type data. According to the NDR specification, arrays are encoded with maximum count, offset, actual count, and elements. In the vmdrd implementation, count fields are transformed into lower and upper variables, representing the starting and ending boundaries of elements. A sanity check exists: if (upper - lower > z_value), the encoded array is deemed invalid, where z_value represents the maximum allowed size.

The critical oversight is that this check only verifies the difference between upper and lower against z_value, but it fails to validate whether lower and upper themselves fall within a valid range. This allows an attacker to specify arbitrary lower and upper values that, while their difference might be within z_value, cause out-of-bounds access relative to the allocated array buffer. This translates into an arbitrary relative address write primitive – a powerful capability that can be escalated to full RCE.

Exploitation Challenges and Techniques for RCE

Exploiting the arbitrary relative address write to achieve RCE in vmdrd presented several significant challenges:

1. Strong Memory Protections: vmdrd is hardened with comprehensive memory protections: Read Only Relocations (RELRO), Stack Canary, NX (No-Execute), and ASLR (Address Space Layout Randomization). These defenses typically render traditional exploitation techniques ineffective.
2. Complex Network Protocol: The DCERPC protocol and its parsing involve numerous uncontrollable memory locations and releases, making precise heap layout manipulation difficult.
3. Multi-threaded RPC Handling: Different RPC requests are processed by different threads, each with its own thread arena for memory allocations. This heap isolation means allocations in one thread do not directly affect others, complicating heap grooming.

The researchers devised clever techniques to overcome these challenges:

• Heap Fragmentation Control: They observed that in a multi-threaded environment, thread arena allocations follow a predictable pattern when a large number of requests are sent, distributing memory allocations evenly. The packet receiving thread creates frag_buff heap chunks. By establishing many connections and flooding with requests, they could "clean up" fragmented heap memory and achieve a more controlled heap layout.
• Information Leak Primitive: Since ASLR randomizes addresses, an information leak was necessary. They converted the arbitrary relative write into an arbitrary relative read. By analyzing the response generation process, they found the buffered_output structure, containing buffer_addr and buffer_len. By overwriting buffer_len with their arbitrary write, they could trick the server into returning more memory than intended, effectively leaking data.

To make this leak useful, they targeted libc function pointers. The DCERPC service frequently uses logging functions that call open_memory_stream, allocating objects containing libc function pointers. By flooding thread arenas with response objects and syslog objects, they could arrange a syslog object to immediately follow a response object. Overwriting the buffer_len of the response object then caused the server to return the syslog object’s memory, revealing valuable libc addresses (e.g., free_hook and system function addresses).

• Arbitrary Address Write Primitive: To achieve a true arbitrary write, they leveraged the frag_buff structure. If the received packet length is smaller than RPC_FRAGMENT_HEADER_B, the receive_packet function loops, updating a pointer I based on data inside the frag_buff structure. By carefully crafting frag_buff objects, they could control the I pointer and thus achieve an arbitrary write.
• Hijacking Control Flow: With the information leak providing libc addresses and the arbitrary address write primitive, hijacking control flow was straightforward. They overwrote the free_hook (a glibc hook called before free()) with the address of the system function. When a specially crafted heap block containing the desired command (e.g., a reverse shell command) was freed, it would be treated as an argument to system(), leading to remote code execution.

Demo / Proof of Concept

▶ Watch: CVE-2024-37080: Olearn control leading to heap overflow (8:00)

The demonstration showcased a sophisticated multi-stage attack to achieve root privileges and subsequently escape the vCenter VM to control the ESXi host.

The privilege escalation vulnerability hinges on a subtle flaw in how the vmdrd process initializes and drops privileges. During initialization, vmdrd attempts to bind to several specific ports, including port 2012, port 636, and port 389. Before binding each port, it checks if the port is already in use. If any required port is occupied, initialization halts. Crucially, vmdrd only calls setgid() and setuid() to drop privileges after successfully binding and initializing all required ports.

The vulnerability lies in the file descriptor inheritance mechanism. While vmdrd sets the FD_CLOEXEC flag for port 2012, preventing its inheritance by child processes, it does not set this flag for port 636 and port 389.

The exploitation process involved a two-stage attack:

1. First Attack (RCE to Persist): The attackers first exploited the heap overflow (Vulnerability 3) to achieve initial RCE as the vmdrd user (a low-privileged user). With this access, they launched a persistent child process. This child process inherited the file descriptors for ports 636 and 389.
2. Second Attack (Privilege Escalation and Root RCE): After the initial RCE and child process launch, the vmdrd process was restarted. Because ports 636 and 389 were now occupied by the persistent child process, vmdrd failed to bind them. Consequently, the privilege-dropping functions (setgid() and setuid()) were never called. However, port 2012 was free (due to FD_CLOEXEC on its descriptor) and vmdrd successfully bound to it. This left the vmdrd process running with root privileges. The attackers then launched a second RCE attack against the now root-privileged vmdrd on port 2012, obtaining a root shell on the vCenter server.

Finally, to escape the vCenter VM and control ESXi, the researchers demonstrated how they found the VPX user password. When an ESXi host first connects to vCenter, it creates a vpxuser account used by vCenter to manage virtual machines. The password for this high-privileged user must be stored somewhere on vCenter. They located the encrypted vpxuser password within the vCenter PostgreSQL database. They then easily found the encryption key on the vCenter server, decrypted the password, and used the vpxuser credentials to gain full control over the ESXi host, effectively compromising the entire virtualized infrastructure.

The demo visually confirmed these steps, showing the initial RCE, the persistence of the child process, the restart of vmdrd, and finally, the successful acquisition of a root shell, followed by the ESXi host compromise.

Defensive Implications

▶ Watch: Third vulnerability: Heap overflow in call request processing (10:00)

The detailed vulnerabilities and exploitation techniques presented in "vCenter Lost" highlight several critical areas where defenders must focus their efforts to secure VMware environments.

1. Prompt Patching: The most immediate and crucial defensive action is to apply all available VMware security patches without delay. While the specific CVEs for all four vulnerabilities were not explicitly stated for all, CVE-2024-37079 and CVE-2024-37080 were mentioned. Given the severity of remote code execution and privilege escalation, any patches addressing DCERPC or vmdrd vulnerabilities should be prioritized.
2. Network Segmentation and Access Control: The vmdrd service listens on port 2012 and is often accessible on all network interfaces. This wide accessibility is a significant risk factor. Defenders must implement strict network segmentation to limit access to vCenter servers, especially port 2012, to only trusted administrative networks and essential components. Untrusted or less-privileged networks should be entirely blocked from accessing vCenter management interfaces.
3. Code Auditing for Protocol Parsers: The root cause of many of these vulnerabilities lies in subtle flaws within the DCERPC and NDR protocol parsers, particularly regarding boundary checks and integer arithmetic. Organizations developing or integrating complex network protocols should invest in rigorous code auditing, fuzzing, and static analysis specifically targeting these areas. Special attention should be paid to integer overflows/underflows, off-by-one errors, and pointer arithmetic, especially when handling attacker-controlled data lengths and offsets.
4. Review of Privilege Dropping Mechanisms: The privilege escalation vulnerability demonstrates that seemingly secure privilege dropping logic can be bypassed by understanding system-level interactions like file descriptor inheritance and process restart behavior. Developers and security architects should review all privilege separation mechanisms to ensure they are robust against race conditions, unexpected process states, and resource contention. All sensitive file descriptors should ideally be marked with FD_CLOEXEC.
5. Least Privilege Principle for Management Accounts: While the vpxuser on ESXi is designed for vCenter management, its high privileges make it a prime target once vCenter is compromised. Defenders should regularly audit the permissions granted to such service accounts. Although full control might be necessary for vCenter's function, understanding its implications is key. Furthermore, the storage and encryption of such critical credentials within databases must be exceptionally strong, with robust key management practices.
6. Monitoring and Detection: Implement comprehensive logging and monitoring for vCenter and ESXi hosts. Look for anomalous activity, such as unexpected process spawning, unusual network connections from vCenter, attempts to access the PostgreSQL database outside of normal operations, or changes to ESXi configurations. Detecting the initial RCE or the persistent child process could be crucial for preventing the full compromise chain.
7. Defense in Depth: Relying on a single layer of defense is insufficient. Combining network segmentation, host-based firewalls, intrusion detection/prevention systems (IDS/IPS), endpoint detection and response (EDR) solutions, and regular security assessments provides a more robust defense against multi-stage attacks like the one demonstrated.

Key Takeaways

• Rigorous Input Validation is Paramount: The vulnerabilities highlight that even in widely adopted and seemingly mature protocols like DCERPC and NDR, subtle flaws in boundary checks, integer arithmetic, and parameter validation can lead to critical heap overflows and arbitrary write primitives.
• Overlooked Code Paths are Risky: Vulnerabilities in less-obvious code paths, such as response generation or specific array decoders within complex serialization formats, are often overlooked during security reviews and can harbor severe security flaws.
• Sophisticated Exploitation Bypasses Modern Defenses: Achieving RCE in hardened, multi-threaded environments with ASLR, NX, and other protections requires advanced techniques like precise heap grooming across thread arenas, converting relative writes to information leaks, and chaining primitives to hijack control flow.
• Privilege Escalation Can Be Subtle: The vmdrd privilege escalation demonstrated how seemingly innocuous code logic related to port binding and file descriptor inheritance can be leveraged in a two-stage attack to bypass intended privilege separation.
• vCenter is a Gateway to ESXi: Compromising vCenter provides a direct path to controlling the entire virtualized infrastructure, including the underlying ESXi hosts, by leveraging pre-existing management accounts and stored credentials.
• Proactive Security for Critical Infrastructure: The presence of in-the-wild exploitation for related vulnerabilities underscores the need for continuous security research, auditing, and prompt patching of critical infrastructure components like VMware vCenter.

About the Speaker(s)

The research presented in "vCenter Lost: How the DCERPC Vulnerabilities Changed the Fate of ESXi" was a collaborative effort by Zo and Hau Yu from Tianin Tangun lab. Zo delivered the presentation at Black Hat Asia 2025, representing the team.

Tianin Tangun lab is dedicated to vulnerability research and exploitation across a broad spectrum of targets, including edge devices, IoT, operating system kernels, virtualization platforms, and web browsers. Their work has been published at prestigious conferences such as Black Hat, DEF CON, and HITB (Hack In The Box), and they have garnered multiple awards at renowned competitions like Pwn2Own, Temp. Cup, and Matrix Cup. The team has a particular focus on VMware security, having conducted long-term research on hypervisor implementations and reported numerous vulnerabilities in the past.