Preface: On October 10, 2023, Citrix released a security advisory regarding a sensitive information disclosure vulnerability (CVE-2023-4966) affecting NetScaler ADC and NetScaler Gateway appliances.

Background: Citrix NetScaler improves performance by using HTTP compression and data caching. The workload is shared over multiple servers and networks to ensure that there is not one point of failure or that one server is not overloaded, causing a slow or inefficient performance.

The Citrix ADC (formerly NetScaler) appliance instantiates the number of PEs based on the number of vCPUs, memory, and licenses.

The packet engine is created to perform TCP/IP processing, optimization tasks and acceleration of packages. This is a continues process of grabbing packets, handling them accordingly and putting the packets in place again, the packet engine is designed to run an entire instance of NetScaler’s packet engine on each processor core (nCore technology) and runs as a kernel component on the NetScaler.

Vulnerability details: Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. 

Official announcement: Please refer to the link for details –

https://support.citrix.com/article/CTX579459/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20234966-and-cve20234967

Preface: When Oracle releases a security advisory. These vulnerabilities may have occurred months ago, or may be further back. But the technical details published in the CVE are only limited. So, that’s one of the reasons I’m interested in digging into the details.

In the spirit of science, everyone dares to assume but careful to verify.

Background: A WebLogic Server 10.3.6, 12.1.3, and 12.2.1.x client can invoke RMI-based applications hosted on a WebLogic Server 14c (14.1.1.0.0) server using IIOP, T3, T3S, HTTP, and HTTPS. JMS applications can be invoked using T3, T3S, HTTP, and HTTPS.

A WebLogic Server 14c (14.1.1.0.0) client can invoke RMI-based applications hosted on

A WebLogic Server 10.3.6, 12.1.3, and 12.2.1.x server using IIOP, T3, T3S, HTTP, and HTTPS. JMS applications can be invoked using T3, T3S, HTTP, and HTTPS.

For WebLogic Server 14c (14.1.1.0.0) instances running on JDK11, IIOP interoperability with Java clients is only available with a WebLogic Server 14c (14.1.1.0.0) install client running on JDK 11.

Vulnerability details: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.

Remark: The vendor did not disclose details. Could this vulnerability occur under this circumstances? Please refer to attached diagram.

Official announcement: Please refer to the link for details –

https://nvd.nist.gov/vuln/detail/CVE-2023-22089

Preface: If you still remember more than ten years ago, a snowhttp attack target web server especially Apache web server. Slow HTTP attacks are denial-of-service (DoS) attacks in which the attacker sends HTTP requests piece by piece at a slow pace to a web server. If an HTTP request is not complete, or if the transfer rate is very low, the server keeps its resources busy waiting for the rest of the data.

Background: HTTP 2.0 uses a binary, length-prefixed framing layer, which offers more compact representation than the newline-delimited plaintext HTTP 1.x protocol and is both easier and more efficient to process.

HTTP/2 makes web pages load faster and more efficiently by simplifying communication between the browser and the server. Accessing a website using the HTTP/2 protocol is as follows: the browser requests a TCP connection. The server establishes a TCP connection. The browser requests the website’s index HTML file.

Vulnerability details: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

Additional: Because of CVE-2023-44487, HTTP/2 enabled web servers are vulnerable to a DDoS attack. It so called “Rapid Reset Attack”.

The HTTP/2 protocol allows clients to indicate to the server that a previous stream should be canceled by sending a RST_STREAM frame. The protocol does not require the client and server to coordinate the cancellation in any way, the client may do it unilaterally.

The ability for an endpoint to send a RST_STREAM frame immediately after sending a request frame, which makes the other endpoint start working and then rapidly resets the request. The request is canceled, but leaves the HTTP/2 connection open. As a result, the server keeps its resources in heavy load status.

Official announcement: Please refer to the link for details – https://nvd.nist.gov/vuln/detail/CVE-2023-44487

Preface: Infrastructure as code (IaC) is the process of dynamically managing and provisioning infrastructure through code instead of through a manual process to simplify app development, configuration, and runtime. IaC uses DevOps methodology and versioning with a descriptive model to define and deploy infrastructure. For example: Cloud comupting platform structure components includes networks, virtual machines, load balancers, and connection topologies.

Infrastructure as code (IaC) uses DevOps methodology and versioning with a descriptive model to define and deploy infrastructure. For example: Cloud comupting platform structure components includes networks, virtual machines, load balancers, and connection topologies.

Remark: A general example of descriptive modeling is business reporting in the form of graphs, charts, and dashboards.

Background: Ansible is an tool for simple automation tasks. Python tool provides more flexibility and control over automation and is an excellent tool for complex automation tasks. Based on Python and Django, it can develop an automated task execution and asset management (CMDB) system with DevOps concept.

Ansible architecture is client-server architecture model. It has three main components: control nodes, managed nodes and communication channels.

Ansible automates Linux and Windows by connecting to managed nodes and pushing out small programs called Ansible modules. Ansible executes these modules, which are the resource models of the desired system state, over Secure Socket Shell (SSH) by default and removes them when finished.

Vulnerability details:

CVE-2023-5115 – ansible-core: malicious role archive can cause ansible-galaxy to overwrite arbitrary files

CVE-2023-41164 – automation-controller: Django: Potential denial of service vulnerability in  django.utils.encoding.uri_to_iri()

Official announcement: Please refer to the link for details –

https://access.redhat.com/errata/RHSA-2023:5701

Security Focus: CVE-2020-36558 appears in this patch. Do you have interest to know the details?

Preface: A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.

Background: RHEL 8.6 includes a wide range of new features and enhancements . Primary features and benefits:

i.Mitigate potential risks across the hybrid cloud – Web console support for Smart Card Authentication with Sudo and SSH to use smart card authentication credentials when performing administrative functions and accessing remote hosts through the RHEL web console.

ii.Support for SAP HANA in production with Red Hat and SAP, a jointly-tested RHEL configuration with SELinux enabled. SELinux’s security technology allows process isolation, offering great privilege escalation attack mitigation to SAP users.

Vulnerability details: CVE-2020-36558 – kernel: race condition in VT_RESIZEX ioctl when vc_cons[i].d is already NULL leading to NULL pointer dereference

Synopsis: The reason for this vulnerability is that the statement “if” judgment is bypassed through conditional competition, so that after obtaining the lock, vc_cons[i].d is still NULL, which means that vc_cons[i].d has a value at the beginning. When the statement “if” After the judgment is made, or before the lock is obtained, set vc_cons[i].d to NULL through another thread. Then, statement “if” you can allocate page 0, you can carefully construct the data and realize reading and writing at any address.

Due to design limitation, before linux 2.6.31, it is possible to allocate 0 pages of memory. Combined with specify vulnerability in 2019, attacker be able to bypass the 0 page allocation limit. So, CVE-2020-36558 should be exploitable.

Ref: The ‘if’ Statement: The basic syntax of the if statement looks like this: if (condition) { // code to be executed if the condition is true; }.

Official announcement: Please refer to the link for details – https://access.redhat.com/errata/RHSA-2023:5627

Preface: Xen is an open-source hypervisor that allows the simultaneous development, execution, and management of multiple virtual machines on one physical computer. Xen offers two types of virtualization: paravirtualization and full virtualization.

Background: The Xen Project hypervisor is an open-source type-1 or bare-metal hypervisor. It allows many instances of an operating system or different operating systems to run in parallel on a single machine (or host). Xen hypervisor is used as the basis for many different commercial and open-source applications, such as: server virtualization, Infrastructure as a Service (IaaS), desktop virtualization, security applications, embedded, and hardware appliances.

Citrix Hypervisor is based on the Xen Project hypervisor, with extra features and supports provided by Citrix. Citrix Hypervisor 8.2 uses version 4.13.4 of the Xen hypervisor.

Vulnerability details: Closing of an event channel in the Linux kernel can result in a deadlock. This happens when the close is being performed in parallel to an unrelated Xen console action and the handling of a Xen console interrupt in an unprivileged guest.

Official announcement: Please refer to the link for details –

https://support.citrix.com/article/CTX575089/citrix-hypervisor-multiple-security-updates

Preface: The Resource Reservation Protocol (RSVP) is a transport layer protocol designed to reserve resources across a network using the integrated services model.

Background: The Resource Reservation Protocol (RSVP) is a transport layer protocol designed to reserve resources across a network using the integrated services model. RSVP operates over an IPv4 or IPv6 and provides receiver-initiated setup of resource reservations for multicast or unicast data flows.

The multicasting prevents unwanted message transmission and avoids clogging of the network.

Vulnerability details: A flaw was found in the IPv4 Resource Reservation Protocol (RSVP) classifier in the Linux kernel. The xprt pointer may go beyond the linear part of the skb, leading to an out-of-bounds read in the `rsvp_classify` function. This issue may allow a local user to crash the system and cause a denial of service.

Ref: The total number of bytes in the packet is ‘len’. SKBs are composed of a linear data buffer, and optionally a set of 1 or more page buffers. If there are page buffers, the total number of bytes in the page buffer area is ‘data_len’. Therefore the number of bytes in the linear buffer is ‘skb->len – skb->data_len’.

Official announcement: Please refer to the link for details –

https://nvd.nist.gov/vuln/detail/CVE-2023-42755

Preface: Smartphone is a digital world microcosm. We know that our digital world includes web services, repositories, virtual machines, high-speed networks, multi-core CPUs, and GPUs. But the average smartphone already includes the infrastructure components just mentioned. Therefore, the security level of smartphones is no less than that of enterprise servers, because this micro world is more strict than you think.

Background: Android 13 builds on the tablet optimizations introduced in Android 12 and the 12L feature drop—including optimizations for the system UI, better multitasking, and improved compatibility modes. AndroidManagerService is the most important service of Android. It is mainly responsible for the startup, switching, scheduling and management of application processes of four components. It plays the role of management process and scheduling module of the operating system.

ActivityManagerService is the process manage and dispatch center in java platform. Furthermore system_server is a system process, it will be included in ActivityManagerService manage scope.

What exactly did ActivityManagerService do when it was constructed? Established execution threads: ServiceThread, mUiHandler, sKillThread, CpuTracker.

Vulnerability details: CVE-2023-21266 could lead to local escalation of privilege with no additional execution privileges needed.

Affected Android versions: 11, 12, 12L, 13

Vulnerability Type: Elevation of privilege

Official announcement: Please refer to the link for details – https://source.android.com/docs/security/bulletin/2023-10-01

Preface: There are indications from Google Threat Analysis Group and Google Project Zero that CVE-2023-33106, CVE-2023-33107, CVE-2022-22071 and CVE-2023-33063 may be under limited, targeted exploitation. Patches for the issues affecting Adreno GPU and Compute DSP drivers have been made available, and OEMs have been notified with a strong recommendation to deploy security updates as soon as possible. Please contact your device manufacturer for more information on the patch status about specific devices.

Background: Qualcomm cDSP is a hardware acceleration unit on the Qualcomm platform specifically used for general computing. Compared with the host CPU, the DSP usually runs at a lower clock speed and provides more parallel instruction levels. This makes DSPs a better alternative to CPUs in terms of power consumption. Therefore, porting as many large computing-intensive tasks as possible to the DSP can reduce the overall power consumption of the device.

The Qualcomm Adreno 640 is a smartphone and tablet GPU that is integrated within the Qualcomm Snapdragon 855 SoC. The chip will be available from early 2019 and will be used mainly in high-end Android devices.

Vulnerability details:

Per announcement by vendor, the details of design weakness on those CVE items not published yet. But OEMs have been notified with a strong recommendation to deploy security updates as soon as possible. An limited information told that vulnerabilities affecting Adreno GPU and Compute DSP drivers have been made available.

Official announcement: Please refer to the link for details – https://docs.qualcomm.com/product/publicresources/securitybulletin