Category Archives: Potential Risk of CVE

Linux Kernel before 4.20.8 kvm_ioctl_create_device Use-After-Free Vulnerability – Feb 2019

Preface: Linus Torvalds, he is the principal developer of the Linux kernel. Many Linux distributions and operating systems are based on Linus Torvalds design foundation.

Synopsis: The module (virt/kvm/kvm_main.c) enables machines with Intel VT-x extensions to run virtual machines without emulation or binary translation. The module (virt/kvm/kvm_main.c) enables machines with Intel VT-x extensions to run virtual machines without emulation or binary translation. However a vulnerability occurs in the kvm_ioctl_create_device function of the Linux Kernel.

Details: The vulnerability exists due to a race condition that causes the kvm_ioctl_create_device function.
Affected software: kvm_main.c source code file

Impact: A successful exploit could trigger a use-after-free condition vulnerability. Thus causes the targeted virtual machine crash ( DoS condition). Besides, a successful exploit could allow the attacker to gain elevated privileges on a targeted system.

Remedy action: https://git.kernel.org/pub/scm/virt/kvm/kvm.git/commit/?id=cfa39381173d5f969daf43582c95ad679189cbc9

About Linux kernel flaw (CVE-2018-5391) – Cisco information update

Preface: Cisco provide status update on CVE-2018-5391 on 18th Feb 2019 , it is the follow up action for Linux kernel flaw announced August last year.

Synopsis: A decade ago, we said that the vulnerabilities of Microsoft windows will be jeopardize the IT world. Perhaps this statement not suitable today because Linux and open sources application encountered risks in frequent.

Vulnerability: From technical point of view, this flaw is easy exploit by attacker. They can send a packet trigger time and calculation expensive fragment reassembly algorithms overload the CPU power.

Don’t neglect this vulnerability:
Perhaps you say that your IPS can filter such malicious attack. The specify product has been patched. So your campus will be secure. But Linux base platform of machines are common today in your IT infrastructure. What if similar of attack is a insider threat. What’s the result?

Cisco official announcement – 18th Feb 2019 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180824-linux-ip-fragment

CVE-2019-7304 – Canonical snapd Local Privilege Escalation Vulnerability – 15th Feb 2019

Preface: Why REST so popular? REST can be used over nearly any protocol, when used for web APIs it typically takes advantage of HTTP.

Canonical snapd technical features: Snap is a software deployment and package management system.It capable to deliver and update your app on any Linux distribution for desktop, cloud, and Internet of Things.

Vulnerability occurred:

  1. Creating a file that contains uid=0 in its name: /tmp/ktgolhtvdk;uid=0;
  2. Binding to socket file – After a UNIX domain socket is created, you must bind the socket to a unique file path by using the bind function.
  3. Then using it to initiate a connection to the snapd socket.
  4. Overwrite the previous user identifier (UID) after the string is parsed and appear to the snapd daemon as a root user.
  5. Allow the attacker to create a new local user with root privileges using the API’s POST /v2/create-user function.

Vendor Announcements: Canonical has released software updates at the following link.

https://github.com/snapcore/snapd/releases

VMware announcement – they resolve mishandled file descriptor vulnerability in runc container runtime (15th Feb 2019)

Preface: Docker containers can be created in VMware. Therefore, VMware and Docker can work together. Therefore, they are not just competitors.

Vulnerability background: Docker announce on 12th Feb 2019 that they are vulnerable for malicious attack. The vulnerability allows a malicious container to overwrite the host runc binary and thus gain root-level code execution on the host.

Impact:
The attacker could trick a user with these permissions into deploying a malicious container or running docker exec for them.

Remedy: VMware product updates resolve mishandled file descriptor vulnerability in runc container runtime (CVE-2019-5736) . For more details, please refer official details shown below: https://www.vmware.com/security/advisories/VMSA-2019-0001.html

Conclusion: VMware is committed to work with the community to help establish common, open standards and specifications for containers on Jul 2017. I think such vulnerability also has impact to Stateful Containers on vSphere with the Orchestrator architecture. Therefore may have announcement will be posted soon!

Container Privilege Escalation Vulnerability (CVE-2019-5736) Affecting Cisco Products – Products under investigation – 15th Feb 2019

Preface: Cisco MSE is distributed as an Open Virtual Appliance (OVA) for installation on a virtual appliance and as an ISO image for installation on a physical appliance. Cisco MSE acts as a platform (physical or virtual Cisco Mobility Services Engine [MSE] appliance) to deploy and run the Cisco services.

Open Container Initiative overview:
OCI currently contains two specifications: the Runtime Specification (runtime-spec) and the Image Specification (image-spec).

Cisco worries that OCI flaw will be affecting his Products:
The /proc/self refers to the current running process’s own environment, exec is actually calling itself. When flaw allow someone improperly handles file descriptors related to /proc/self/exe. In the sense that attacker similar escalate privileges on a targeted system.

For more details, refer below Official announcement: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190215-runc

Security Focus – CVE-2019-0626 Microsoft Windows DHCP Server Remote Code Execution Vulnerability (12th Feb 2019)

Preface: This vulnerability is included in MS Patch Tue this week. However the vulnerability is more critical than others. Since threat actor can be conduct a remote code execution through social engineering.

Technical highlight: The official announcement told that attacker could exploit the vulnerability by sending a DHCP packet that submits malicious input to the affected software because a design weakness occurs in software (DHCP server) which has a flaw of handles objects in memory. A successful exploit could allow the attacker to execute arbitrary code and compromise the system completely.

My observation: We did not found additional details of this vulnerability. My speculation is that whether windows 2008 DHCP server has non page memory leak flaw which causes this problem. What do you think?

Official remediation: CVE-2019-0626 | Windows DHCP Server Remote Code Execution Vulnerability

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0626

Advantech WebAccess/SCADA Multiple Security Vulnerabilities – Jan 2019

Preface: Advantech is a leading brand in IoT intelligent systems, Industry 4.0, machine automation, embedding computing, embedded systems, transportation, …

New vulnerabilities found in WebAccess/SCADA Version 8.3:
CVE-2019-6519 – An improper authentication vulnerability exists that could allow a possible authentication bypass allowing an attacker to upload malicious data.
CVE-2019-6521 – Specially crafted requests could allow a possible authentication bypass that could allow an attacker to obtain and manipulate sensitive information.
CVE-2019-6523 – The software does not properly sanitize its inputs for SQL commands.

Status: Vendor do not have patch release in the moment (see below url)

https://support.advantech.com/support/DownloadSRDetail_New.aspx?SR_ID=1-MS9MJV&Doc_Source=Download

Recommendation: Enforce access control. Meanwhile install SIEM facility to enhance the preventive and detective control.

Docker (runc) – Malicious container escape – CVE-2019-5736 (11th Feb 2019)

Preface: runc is a CLI tool for spawning and running containers according to the OCI specification.

Vulnerability: Found vulnerability on runc affecting several open-source container management systems that leverage runc

Impact: The vulnerability allows a malicious container to overwrite the host runc binary and thus gain root-level
code execution on the host. But exploit this vulnerability requires user interaction.

Remedy: Official announcement:
Redhat – https://access.redhat.com/security/vulnerabilities/runcescape
AWS – https://aws.amazon.com/security/security-bulletins/AWS-2019-002/

Cisco finally fixed Elastic Services Controller Service 3.0 Portal Authentication Bypass Vulnerability (CVE-2018-0121) – 8th Feb 2019

Preface: It was because of new version 4.0 introduced on Jan 2018. Cisco urge customers upgrade to 4.0 to do the remediation. The Elastic Services Controller Service Portal Authentication Bypass Vulnerability finally fixed on Feb 2019.

Product background: Cisco ESC provides a single point of control to manage all aspects of VNF lifecycle for generic Virtual Network Functions (VNFs) in a dynamic environment. ESC brings advanced capabilities like VM and Service monitoring, auto-recovery and dynamic scaling.

Speculate the technical weakness on similar design function: Perhaps the problem given by Vulnerabilities of using a REST API token based authentication! So the official announcement state that vulnerability is due to improper security restrictions that are imposed by the web-based service portal of the affected software.

Official announcements: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-esc

CVE-2019-6978 – GD Graphics Library gdImage*Ptr() Functions Double Free Vulnerability – Feb 2019

Preface: GD is extensively used with PHP. As of PHP 5.3, a system version of GD may be used as well, to get the additional features that were previously available only to the bundled version of GD.

Technical background: The LibGD 2.2.5 allow to written C code to load an entire image file into a buffer in memory, then ask gd to read the image from that buffer. But the programmer must responsible for allocating the buffer, apart from that a customized function must responsible for freeing the buffer with your normal memory management functions.

Vulnerability found: A vulnerability in GD Graphics Library (libgd) could allow an unauthenticated, remote attacker to execute arbitrary code on a targeted system.

Doubt: Similar vulnerability was found on 2017 (Double-free in gdImagePngPtr(). (CVE-2017-6362)).
LibGD 2.2.5 release announced that Double-free in gdImagePngPtr(). (CVE-2017-6362) has been fixed!

Vendor announcements: https://github.com/libgd/libgd/issues/492