# Revisiting OMI: Analysis of CVE-2022-29149, a privilege escalation vulnerability in Azure OMI

OMI's secretString was seeded with process start time, letting a local attacker predict it and forge privileged messages to escalate to root.

- Payout: Research
- Severity: high
- Program: Azure OMI
- Credited: Wiz Research
- Disclosed: 2022-08-05
- CVE: CVE-2022-29149
- Write-up quality: 7/10
- Original: https://www.wiz.io/blog/omi-returns-lpe-technical-analysis
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-omi-returns-lpe-technical-analysis
- Tags: domain:cloud impact:privesc kind:research platform:threat-intel sev:high tech:linux technique:incomplete-fix technique:source-review vuln:crypto vuln:privilege-escalation

**Target:** OMI cloud middleware agent on Azure Linux VMs
**Root cause:** GenerateRandomString seeds srand() with time(), so the secretString used to authenticate high-privilege internal OMI messages is predictable from the process start time.
**Steps:**
1. Identify OMI process start time (e.g. via process listing/uptime).
2. Reimplement GenerateRandomString with srand((unsigned)time(start_time)) to recover secretString.
3. Forge internal messages signed with the recovered secretString as if from the privileged OMI process.
4. Send forged messages to bypass the CVE-2021-38645 patch and elevate to root.
**How found:** Reviewing Microsoft's large patch, researchers noticed removal of the secretString mechanism and questioned why; inspecting GenerateRandomString revealed time()-based seeding, prompting them to test predictability.
**Exploitation:** Local attacker on an Azure Linux VM recovers the secretString by brute-forcing the seed space around the OMI process launch time, then forges privileged internal communications to bypass the prior LPE patch and gain root.
**Escalation:** Chains predictable RNG with the CVE-2021-38645 patch bypass to achieve root privilege escalation.
**Insight:** When a patch removes an authentication secret entirely, treat it as a signal the secret was weak; check RNG seeding (time-based srand) and whether process start time is observable to predict secrets.