Red Hat Security Advisory: kernel security, bug fix, and enhancement update

1. Architecture and Design

   Use locking functionality. This is the recommended solution. Implement some form of locking mechanism around code which alters or reads persistent data in a multithreaded environment.

2. Architecture and Design

   Create resource-locking validation checks. If no inherent locking mechanisms exist, use flags and signals to enforce your own blocking scheme when resources are being used by other threads of execution.

OWASP Cheat Sheets

• Abuse Case (opens in a new tab)

OWASP ASVS 4.0.3

• V1.11.2 (opens in a new tab)

Attack patterns

• Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions (opens in a new tab)
• Leveraging Race Conditions (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Implementation

   The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.

2. Implementation

   When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.

3. Architecture and Design

   Limit the interleaving of operations on files from multiple processes.

OWASP Cheat Sheets

• Abuse Case (opens in a new tab)

OWASP ASVS 4.0.3

• V1.11.3 (opens in a new tab)
• V11.1.6 (opens in a new tab)
• V1.11.2 (opens in a new tab)

Attack patterns

• Leveraging Race Conditions via Symbolic Links (opens in a new tab)
• Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Implementation

   Only call matching memory management functions. Do not mix and match routines. For example, when you allocate a buffer with malloc(), dispose of the original pointer with free().

2. Implementation

   When programming in C++, consider using smart pointers provided by the boost library to help correctly and consistently manage memory.

3. Architecture and Design · Libraries or Frameworks

   Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Architecture and Design · Implementation

   Implement a reliable lock mechanism.

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Architecture and Design

   Choose a language that provides automatic memory management.

2. Implementation

   When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

OWASP Cheat Sheets

• XML Security (opens in a new tab)
• Mass Assignment (opens in a new tab)

OWASP ASVS 4.0.3

• V13.3.1 (opens in a new tab)
• V5.1.4 (opens in a new tab)
• V5.1.3 (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Implementation

   Make sensitive open/close operation non reachable by directly user-controlled data (e.g. open/close resources)

2. Implementation · Input Validation

   Perform input validation on user data.

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Implementation

   For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished.

2. Requirements

   Select a programming language that is not susceptible to these issues.

3. Implementation

   Check the results of all functions that return a value and verify that the value is non-null before acting upon it.

OWASP Cheat Sheets

• Logging (opens in a new tab)
• Error Handling (opens in a new tab)

OWASP ASVS 4.0.3

• V11.1.7 (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Requirements · Language Selection

   Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

2. Architecture and Design

   Design signal handlers to only set flags, rather than perform complex functionality. These flags can then be checked and acted upon within the main program loop.

3. Implementation

   Only use reentrant functions within signal handlers. Also, use validation to ensure that state is consistent while performing asynchronous actions that affect the state of execution.

OWASP Cheat Sheets

• Abuse Case (opens in a new tab)

OWASP ASVS 4.0.3

• V1.11.2 (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Requirements · Language Selection

   Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

2. Architecture and Design · Libraries or Frameworks

   Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

3. Operation · Build and Compilation · Environment Hardening

   Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index…

OWASP Cheat Sheets

• Docker Security (opens in a new tab)
• XML Security (opens in a new tab)

OWASP ASVS 4.0.3

• V5.4.1 (opens in a new tab)
• V14.1.2 (opens in a new tab)
• V13.3.1 (opens in a new tab)

Attack patterns

• Buffer Overflow via Environment Variables (opens in a new tab)
• Overflow Buffers (opens in a new tab)
• Client-side Injection-induced Buffer Overflow (opens in a new tab)
• Filter Failure through Buffer Overflow (opens in a new tab)
• MIME Conversion (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Architecture and Design · Language Selection

   Choose a language that provides automatic memory management.

2. Implementation · Attack Surface Reduction

   When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

OWASP Cheat Sheets

• XML Security (opens in a new tab)
• Mass Assignment (opens in a new tab)

OWASP ASVS 4.0.3

• V13.3.1 (opens in a new tab)
• V5.1.4 (opens in a new tab)
• V5.1.3 (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Architecture and Design

   In languages that support it, use synchronization primitives. Only wrap these around critical code to minimize the impact on performance.

2. Architecture and Design

   Use thread-safe capabilities such as the data access abstraction in Spring.

3. Architecture and Design

   Minimize the usage of shared resources in order to remove as much complexity as possible from the control flow and to reduce the likelihood of unexpected conditions occurring.

OWASP Cheat Sheets

• Abuse Case (opens in a new tab)
• Secure Design Principles (opens in a new tab)

OWASP ASVS 4.0.3

• V1.11.2 (opens in a new tab)

Attack patterns

• Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions (opens in a new tab)
• Leveraging Race Conditions (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).