About CVE-2021-3802, Fedora & Ubuntu already address this matter, it is a reminder (29-11-2021).

Preface: (2021-07-30) Reported to KDE and GNOME development teams – In response, patches for both kio and glib were implemented.
However, both projects rely mainly on udisks and use own code only as fallback.

Background: Ubuntu used to have Unity desktop in its default edition but it switched to GNOME desktop since version 17.10 release.
Ubuntu offers several desktop flavors and the KDE version is called Kubuntu. GNOME is the default desktop for Fedora and KDE is the default desktop for OpenSUSE. Depending on how old your Linux distribution is you might have udisks or udisks2 (fourth process) and then you have the udev daemon (second process).

One of the characteristics of Dbus, if you plug in a USB storage device. Dbus and UDisks2 will notified you device is ready.


Remark (a): udisks2 is used by KDE and GNOME nowadays at least (since years). udisks (1) is outdated/obsolete.

Remark (b): The one is udisks which deals with storage devices like USB sticks and the like. The second is udev, a daemon that deals with all kind of devices from PCI boards to the keyboard and mouse (including everything that udisks deals with).

Vulnerability details: Several user-accessible mount helpers use insecure defaults which allow ext2/3/4 file systems to cause a denial of service (kernel panic) upon mounting a crafted image.

Official announcementhttps://bugzilla.redhat.com/show_bug.cgi?id=2003649

Udisks2 hides certain devices from the user by default. You can enter the following directory for review:

Fedora – /usr/lib/udev/rules[.]d/80-udisks2[.]rules

CVE-2021-23654 – This affects all versions of package html-to-csv. The flaw let threat actor can embed or generate a malicious link or execute commands via CSV files (26-11-2021)

Preface: CSV file is a useful thing in today’s world when we are talking about machine learning, data handling, and data visualization.

Background: There are many Raw storage bucket for big data analytic. You might store it in a text format such as JavaScript Object Notation (JSON) or comma-separated values (CSV), or perhaps even Apache Avro. Most people prefer to store it in either JSON or CSV files. CSV format is about half the size of the JSON and another format file. It helps in reducing the bandwidth, and the size of the below would be very less. Therefore, csv is one of the important data types used in the field of data analysis.

Vulnerability details: When there is a formula embedded in a HTML page, it gets accepted without any validation and the same would be pushed while converting it into a CSV file. Through this a malicious actor can embed or generate a malicious link or execute commands via CSV files.

Impact: This affects all versions of package html-to-csv.

Official details: Please refer to the link for details – https://security.snyk.io/vuln/SNYK-PYTHON-HTMLTOCSV-1582784

Reference: BeautifulSoup parsing flaw – None of the parsing error is caused due to BeautifulSoup. It is because of external parser use (html5lib, lxml) since BeautifulSoup doesn’t contain any parser code. One way to resolve above parsing error is to use another parser.

Python built-in HTML parser causes two most common parse errors, HTMLParser.HTMLParserError: malformed start tag and HTMLParser.HTMLParserError: bad end tag and to resolve this, is to use another parser mainly: lxml or html5lib.

About Zoom vulnerability CVE-2021-34423 (25-11-2021)

Preface: What if you need to decide to buy remote meeting software? In front of you, Microsoft Teams, Zoom, and Cisco WebEx. What is your final decision? Or you decide to buy all, because all three items have design weakness but it is under enhancement.

Background: What is H.323 suite H.323 is a standard developed by the ITU. It specifies packet-based multimedia communications systems across networks, which might not provide any Qos guarantees. H.323 suite is family of standards that includes many other ITU standards (See attached diagram for details).

A Room Connector (Zoom) can also call out to a H.323 or SIP device to join a Zoom cloud meeting. Use this API to add a H.323/SIP device to your Zoom account.

A H.323 or SIP device can make a video call to a to join a Zoom cloud meeting.

Vulnerability details: A buffer overflow vulnerability was discovered in the products listed in the “Affected Products” section of this bulletin. This can potentially allow a malicious actor to crash the service or application, or leverage this vulnerability to execute arbitrary code.

Observation 1: The vulnerability is due to a failure to properly validate certain fields in an H.323 protocol suite message. When processing the malicious message, the affected device may attempt to access an invalid memory region, resulting in a crash. An attacker who can submit an H.323 packet designed to trigger the vulnerability could cause the affected device to crash and restart.

Observation 2: Believed that Zoom products contain vulnerabilities in the processing of Session Initiation Protocol (SIP) INVITE messages. These vulnerabilities were identified by the University of Oulu Secure Programming Group (OUSPG) “PROTOS” Test Suite for SIP and can be repeatedly exploited to produce a denial of service.

Official announcement: https://explore.zoom.us/en/trust/security/security-bulletin/

About CVE-2021-21980 – VMware found SSRF, arbitrary file read flaws in vCenter Server (24-11-2021)

Preface: VMware Flash End of Life and Supportability (78589) – https://kb.vmware.com/s/article/78589

Background: Flex is a powerful, open source application framework that allows you to build mobile applications for iOS, Android, and BlackBerry Tablet OS devices, as well as traditional applications for browsers and desktops using the same programming model, tool, and codebase. From a platform perspective, the vSphere Web Client is based on Apache Flex, which used to be called Adobe Flex. Adobe Flex is a Flash-based platform so it requires Adobe Flash to be installed in order to run.

Ref: Flex uses MXML to define UI layout and other non-visual static aspects, ActionScript to address dynamic aspects and as code-behind, and requires Adobe AIR or Flash Player at runtime to run the application.

Vulnerability details: VMware has released important security updates to address two vulnerabilities in the vSphere Web Client (FLEX/Flash) portion of vCenter Server. CVE-2021-21980 is an arbitrary file read vulnerability in the vSphere Web Client and CVE-2021-22049 contains an SSRF (Server Side Request Forgery) vulnerability in the vSAN Web Client (vSAN UI) plug-in. An attacker with access to port 443 on vCenter Server could gain access to sensitive information or take control of a system.

The vCenter Server 7.x and Cloud Foundation 4.x release lines are not affected by these vulnerabilities as they do not use the vCenter Server vSphere Web Client (FLEX/Flash).

Official announcement: https://www.vmware.com/security/advisories/VMSA-2021-0027.html

Reminder: So far, Flash/Flex has discovered many design weaknesses. The defects display on attached diagram are not new items, but what do you think is the design defect that the supplier repaired this week, does it include related relationships, or has the supplier discovered a new defect?

CVE-2021-28706 About Xen memory management design weaknesses (24-11-2021)

Preface: Who uses Xen? Amazon Web Services alone runs ½ million virtualized Xen Project instances according to a recent study and other cloud providers such as Rackspace and hosting companies use the hypervisor at extremely large scale. Xen is a type-1 bare-metal hypervisor.

Background: A Xen host will run a number of virtual machines, VMs, or domains (the terms are synonymous on Xen). One of these is in charge of running the rest of the system, and is known as “domain 0”, or “dom0”.
Any other VM is unprivileged, and are known as a “domU” or “guest”.

A hypercall is based on the same concept as a system call. System calls are used by an application to request services from the OS and provide the interface between the application or process and the OS. Hypercalls work the same way, except the hypervisor is used.

Vulnerability details: (Official description) – When a guest is permitted to have close to 16TiB of memory, it may be able to issue hypercalls to increase its memory allocation beyond the administrator established limit. This is a result of a calculation done with 32-bit precision, which may overflow. It would then only be the overflowed (and hence small) number which gets compared against the established upper bound.

Impact: A guest may be able too allocate unbounded amounts of memory to itself. This may result in a Denial of Service (DoS) affecting the entire host.

Workaround: Setting the maximum amount of memory a guest may allocate to strictly less than 1023 GiB will avoid the vulnerability.
 Example: This should work within the DomU:

echo $((4096*1024*1024)) >/proc/xen/balloon

Should resize the memory to 4 GB.

Official article: Please refer to the link – https://xenbits.xenproject.org/xsa/advisory-385.txt

About NVIDIA GPU vulnerabilities -22nd Nov 2021

Preface: NVIDIA, the inventor of the Graphics Processing Unit (GPU) brings visual computing excellence to the embedded world. High performance meets low power with the NVIDIA Tegra processor – get ready for HD video, crisp graphics and unprecedented 3D capabilities, all in one power efficient package.

Background: GPUDirect Storage kernel driver nvidia-fs.ko is a kernel module to orchestrate IO directly from DMA/RDMA capable storage to user allocated GPU memory on NVIDIA Graphics cards. NVIDIA GPU using DMAdirect. There are DMA engines in GPUs and storage-related devices like NVMe drivers and storage controllers but generally not in CPUs. Because of this external extended resources allocation implemented in Nvidia GPU design. So when you open the resource files package (gds-nvidia-fs). You will find two types of RDMA files. The nvfs-rdma[.]c files are source files which will be compiled. The nvfs-rdma[.]h files are used to expose the API of a program to either other part of
that program or other program is you are creating a library.

Remark: Usually, GPUDirect kernel module is set to load by default by the system startup service. If it is not loaded, GPUDirect RDMA would not work, which would result in a very high latency for message communications.

The high-risk scoring items caught my attention (see below):

CVE‑2021‑23201 – NVIDIA GPU and Tegra hardware contain a vulnerability in an internal microcontroller which may allow a user with elevated privileges to generate valid microcode. This could lead to information disclosure, data corruption, or denial of service of the device.

CVE‑2021‑23217 – NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller which may allow a user with
elevated privileges to instantiate a specifically timed DMA write to corrupt code execution, which may impact confidentiality, integrity,
or availability.

As usual, vendor not convenient to elaborate the vulnerabilities reason in details. However if you are interested of this design weakness.
You can find the hints to narrow down the item then do a summary. Even if it may not be accurate. But there is no harm in doing this research.

Be my guest. Refer to diagram, the well known vulnerabilities is given by dirver (nvlddmkm[.]sys). Nvlddmkm[.]sys error is a well-known error. However I believe the vulnerability occurred this time may extend the impact to other edge. For example CPU (please refer to step 5,6 &7 display on attached diagram).

Official details and remedy: Please refer to the link – https://nvidia.custhelp.com/app/answers/detail/a_id/5263

Vulnerabilities discovered so far in GCC c++filt v2.26.Is it all solved now? (18-11-2021)

Preface: Not limited to traditional Linux, Apple also has cplus-dem[.]c open source.

Background:

What is GCC used for? GCC stands for GNU Compiler Collections which is used to compile mainly C and C++ language. It can also be used to compile Objective C and Objective C++.

File (cplus-dem.c) lives in both GCC and libiberty. Cplus-dem[.]cis part of the libiberty library.Libiberty is free software. This file imports xmalloc and xrealloc, which are like malloc and realloc except that they generate a fatal error if there is no available memory.

In C, the malloc() function will allocate memory on the heap and return a pointer to the address of the allocated memory. Whenever malloc() is used, you will most likely hear of the free() function being used, which as the name indicates will free or deallocate the address of the memory allocation presented by the pointer returned from malloc().

How the computer tracks these allocations and frees?
Computer through a dynamic data structure known as a “linked list” (lists in which each block includes a pointers to the next block on the list).
The linked list keeps track of the free blocks of memory within the system.

Vulnerability details: GCC c++filt v2.26 was discovered to contain a use-after-free vulnerability via the component cplus-dem.c.

Official details: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99188

Remediation: It has not been announced yet.

CVE-2021-43997 – Amazon FreeRTOS encounter vulnerability (18th Nov, 2021)

Preface: Amazon now “owns” FreeRTOS, in the sense that the company will provide all support going forward. FreeRTOS includes a kernel and a growing set of software libraries suitable for use across industry sectors and applications. To support a growing number of use cases, AWS provides software libraries that offer enhanced functionality including connectivity, security, and over-the-air updates.

Background: FreeRTOS is customised using a configuration file called FreeRTOSConfig.h. Every FreeRTOS application must have a FreeRTOSConfig.h header file in its pre-processor include path. FreeRTOSConfig.h tailors the RTOS kernel to the application being built. It is therefore specific to the application, not the RTOS, and should be located in an application directory, not in one of the RTOS kernel source code directories.

Reference:

Functions implemented in “application_defined_privileged_functions.h” must save and restore the processor’s privilege state using the prvRaisePrivilege() function and portRESET_PRIVILEGE() macro respectively. For example, if a library provided print function accesses RAM that is outside of the control of the application writer, and therefore cannot be allocated to a memory protected user mode task, then the print function can be encapsulated in a privileged function.

Official reminder: Above technique should only be use during development, and not deployment, as it circumvents the memory protection.

Vulnerability details: Amazon FreeRTOS 10.2.0 through 10.4.5 on the ARMv7-M and ARMv8-M MPU platforms does not prevent non-kernel code from calling the xPortRaisePrivilege and vPortResetPrivilege internal functions.

Remedy: This is fixed in 10.4.6 and in 10.4.3-LTS Patch 2.

Official announcement: https://github.com/FreeRTOS/FreeRTOS-Kernel/releases/tag/V10.4.6

Security Focus on SMU Mailbox (CVE-2021-26331) -16th Nov 2021

Preface: Quick way to understand difference in between Ryzen and EPYC (see below):

About Ryzen: Some said, Ryzen CPUs are best suited for gaming PCs.
However, AMD has announced its newest range of mobile chips,
the Ryzen 5000 mobile series, which it claims will be used in 1500 devices during 2021.

About EPYC: AMD and Google Cloud have announced the beta availability of Confidential Virtual Machines (VMs) for Google Compute Engine powered by 2nd Gen AMD EPYC processors, taking advantage of the processors’ advanced security features.

Background: The system management unit (SMU) is a sub-component of the northbridge that is responsible for a variety of system and power management tasks during boot and runtime. The SMU contains a micro-controller to assist. The micro controller can be interrupted to cause it to perform several initialization and runtime tasks. BIOS and ACPI methods can interrupt the SMU to request a specific action.

Ref: It is worth mentioning that AMD’s SMU mechanism. SMU is the system management unit. When silent, the power consumption of Ryzen is controlled by SMU. The management functions of SMU include power consumption, current, temperature limiter, voltage controller and power consumption. Threshold etc. The voltage we see in the overclocking software is the upper limit voltage of the processor considered by SMU.
For example, the 1.35V voltage we see in the overclocking software is actually equivalent to a voltage of about 1.2V.

Vulnerability details: CVE-2021-26331 – Certain versions of 1st Gen AMD EPYC from AMD contain the following vulnerability:

AMD System Management Unit (SMU) contains a potential issue where a malicious user may be able to manipulate mailbox entries leading to arbitrary code execution.

Speculation: Each CPU class has completely different function/command IDs for the SMU. The standard mechanism will do a search. A design weakness occurs becuase the input validation feature do not contain on source file (smu[.]c). Therefore, it provides a possibilities to a malicious user send a command. As a result, to manipulate mailbox entries leading to arbitrary code execution.

Headline news – AMD reveals an Epyc 50 flaws – 23 of them rated high severity , said theregister[.]com. Official details please refer to the link – https://web.archive.org/web/20211112012410/https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1021

Review of major events (from windows 7 to AMD display driver design weakness) 15th Nov, 2021

Preface: Long time ago, digital world try to avoid malware infection. Malware has few different types. Memory-resident malware, also known as fileless malware, is a type of malicious software that writes itself directly onto a computer’s system memory. This behavior leaves very few signs of infection, making it difficult for traditional tools and non-experts to identify. Therefore software engineer invented ASLR to fight against them. Apart from that the public announcement said, 64 bit software OS contained anti-malware function. So people are imagine that our digital is secure forever.

Situation in the past ten years: The NTQuerySystemInformation function is implemented on NTDLL. And as a kernel API, it is always updated in the Windows version without any notice. The software developers revealed the reality afterwards. KASLR can be trivially bypassed by an exploit executed at medium-integrity through the use of the well-known EnumDeviceDrivers and NtQuerySystemInformation APIs. As such, NtQuerySystemInformation may be altered or unavailable in future versions of Windows. Perhaps it should use the other functions for replacement. But how about the EnumDeviceDrivers ?

Remark (1): EnumDeviceDrivers – Retrieves the load address for each device driver in the system. i.e. It enums already loaded device drivers.

A story can tell: In Windows 10 Redstone 2 (2017), the UserHandleTable containing the kernel-mode address of all objects allocated on the Desktop heap was removed, however the Desktop heap itself was still mapped in user-mode, allowing us to search through it and locate a specific object. Attacker can creating a window through the CreateWindowEx API, grabbing the address of the user-mode mapped Desktop heap from offset in the TEB, and performing a brute-force search for the Window handle on the user-mode mapped Desktop heap to obtain the offset. It sound likes bypass Kernel ASLR.

Remark (2): Every desktop object requires memory to store UI objects, such as windows and menus. This memory is called desktop heap.
When applications require a UI object, functions within user32. dll are called, and desktop heap memory is allocated.

Remark (3): Remark: TEB(winternl.h) – Win32 apps – The Threat Environment Block (TEB structure) describes the state of a thread.

Summary: In analysis of the AMD Escape calls, a potential set of weaknesses in several APIs was discovered, which could result in escalation of privilege, denial of service, information disclosure, KASLR bypass, or arbitrary write to kernel memory. Please refer to the link – https://web.archive.org/web/20211113054717/https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1000