Intel

CVE-2023-29552

IETF Service Location Protocol (SLP) — Service Location Protocol (SLP) Denial-of-Service Vulnerability

criticalKEV: actively exploitedPoCEPSS 66%

Description

The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use spoofed UDP traffic to conduct a denial-of-service attack with a significant amplification factor.

Source: CISA_KEVNVDCVEORGCVELISTV5

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2023-29552 is on the CISA KEV list because SLP has been demonstrated as a UDP amplification vector with a documented amplification factor of up to 2,200x, making it one of the most potent known DDoS amplification primitives. The EPSS score of 65.87 % at the 99.2nd percentile signals an exceptionally high exploitation probability, and the CVSS vector AV:N/AC:L/PR:N/UI:N confirms that exploitation requires no authentication, no user interaction, and no special conditions. Organisations most at risk are those with internet-reachable ESXi hosts, NetApp storage systems, or SUSE servers that have not filtered port 427/UDP — exactly the kind of data-centre and KRITIS infrastructure common in energy, healthcare, and colocation environments. CISA has not flagged ransomware use, but the primary risk is weaponisation of your infrastructure as a reflected amplifier against third parties, which carries direct NIS2 implications around availability of critical services and potential notification obligations.

Runbook · Step 1

Immediate response (0-24 h)

  • Disable the SLP service immediately on all exposed systems: VMware ESXi 7.0 (check with esxcli system slp stats get, then disable via esxcli system slp disable), NetApp SMI-S Provider, SUSE Linux Enterprise Server, and SUSE Manager Server. SLP is rarely required in modern environments — disabling it is the safest and fastest remediation.
  • Block port 427/UDP and 427/TCP at the perimeter firewall and on host-based firewalls. No legitimate external access to SLP is expected; blocking has no impact on production workloads.
  • Verify patch status: VMware released fixes in ESXi 7.0 Update 3o (Build 21424296) and ESXi 8.0 Update 1a. For NetApp SMI-S Provider and SUSE products, consult the respective vendor advisories — verify exact version numbers there before deploying.
  • Inventory exposed assets: Run a UDP port scan across all network ranges (nmap -sU -p 427 <range>) to identify unknown SLP instances, especially in OT/ICS segments and data-centre infrastructure.
  • Review outbound UDP telemetry: Unusually high volumes of outbound UDP responses from internal hosts on port 427 may indicate active abuse of your infrastructure as an amplification reflector.

Runbook · Step 2

Mitigation layers

  • Network segmentation: Restrict SLP traffic exclusively to management VLANs; deny routing between SLP hosts and the internet or untrusted segments. Apply ACLs on core switches: deny udp any any eq 427.
  • Ingress/egress filtering (BCP38): Drop spoofed-source-IP packets at the network edge. Without BCP38-compliant filtering, UDP amplification attacks are trivially executable. Enable uRPF (Unicast Reverse Path Forwarding) on border routers and firewalls.
  • IPS/IDS rule: Suricata rule to flag oversized SLP response packets: alert udp any 427 -> any any (msg:"SLP Amplification Response"; dsize:>512; sid:9002355; rev:1;). Additionally, configure rate-based thresholds per source IP for SLP response traffic.
  • Registration hardening: If SLP cannot be fully disabled, configure the SLP Directory Agent (DA) to reject unauthenticated service registrations where the implementation permits — note that RFC 2608 does not mandate authentication, so options are implementation-specific.
  • VMware-specific hardening: On ESXi, additionally disable the Managed Object Browser (MOB) and any other non-essential services; enable Lockdown Mode to further reduce the attack surface.
  • Rate-limiting: Apply UDP rate-limiting for port 427 on firewalls and load balancers to cap amplification volume if the service cannot be shut down immediately.

Runbook · Step 3

Detection rules

  • Network telemetry (Zeek/Suricata): High volume of outbound UDP packets from internal hosts on port 427 with large payloads — threshold: >100 packets/minute per source IP. KQL snippet (Microsoft Sentinel): NetworkCommunicationEvents | where RemotePort == 427 and Protocol == "UDP" | summarize count() by LocalIP, bin(TimeGenerated, 1m) | where count_ > 100
  • Linux auditd / SUSE: Monitor for slpd process execution: auditctl -a always,exit -F arch=b64 -S execve -F exe=/usr/sbin/slpd -k slp_start. Unexpected restarts of the service after it has been disabled are an indicator of persistence.
  • VMware ESXi syslog: Search ESXi syslog for entries containing slpd or SLP registration to detect unexpected service activity. Sigma rule shape: title: ESXi SLP Service Activity | logsource: product: vmware_esxi | detection: keywords: - 'slpd' - 'SLP registration'
  • Firewall logs: Any connection attempt to port 427/UDP originating from the internet or from unauthorised internal segments should be treated as a finding — once blocking controls are in place, any hit is actionable.
  • NetFlow/IPFIX volume anomaly: A sudden spike in outbound UDP traffic volume from hosts that were running SLP is a strong amplification indicator; correlate with baseline deviation alerts in your network monitoring platform.

Metrics

Severity
critical
Priority score
201.70
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
7.5
Source: nvd-v3
CVSS v3
7.5
CVSS v4
—
EPSS percentile
99.2 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
65.9 %
High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
Published
2023-11-08 00:00 UTC
CWE
—

Affected operating systems

  • linux

    suse / linux_enterprise_server11

  • linux

    suse / linux_enterprise_server12

  • linux

    suse / linux_enterprise_server15

  • other

    vmware / esxi

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • netapp

    smi-s_provider

  • service_location_protocol_project

    service_location_protocol

  • suse

    manager_server

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

IDCVE-2023-29552
IETF Service Location Protocol (SLP) — Service Location Protocol (SLP) Denial-of-Service Vulnerability — CVE-2023-29552 | NEOSEC Intel