Red Hat Security Advisory: Red Hat AI Inference Model Optimization Tools 3.4.7 (CUDA)

1. Implementation · Input Validation

   Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.

2. Architecture and Design

   For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks…

3. Implementation · Input Validation

   Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174).

OWASP Cheat Sheets

• Authorization (opens in a new tab)

OWASP ASVS 4.0.3

• V12.3.1 (opens in a new tab)

Attack patterns

• Path Traversal (opens in a new tab)
• Using Slashes and URL Encoding Combined to Bypass Validation Logic (opens in a new tab)
• Manipulating Web Input to File System Calls (opens in a new tab)
• Using Escaped Slashes in Alternate Encoding (opens in a new tab)
• Using Slashes in Alternate Encoding (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Architecture and Design · Implementation

   Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.

2. Implementation

   If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.

OWASP Cheat Sheets

• Transport Layer Protection (opens in a new tab)
• TLS Cipher String (opens in a new tab)
• OWASP Authentication (opens in a new tab)

OWASP ASVS 4.0.3

• V9.2.1 (opens in a new tab)
• V1.9.2 (opens in a new tab)
• V2.8.5 (opens in a new tab)

Attack patterns

• Creating a Rogue Certification Authority Certificate (opens in a new tab)
• Signature Spoofing by Improper Validation (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

OWASP Cheat Sheets

• OWASP Authentication (opens in a new tab)

OWASP ASVS 4.0.3

• V2.8.5 (opens in a new tab)
• V2.8.4 (opens in a new tab)
• V9.2.3 (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Requirements

   Specify which data in the software should be regarded as sensitive. Consider which types of users should have access to which types of data.

2. Implementation

   Ensure that any possibly sensitive data specified in the requirements is verified with designers to ensure that it is either a calculated risk or mitigated elsewhere.

3. System Configuration

   Setup default error messages so that unexpected errors do not disclose sensitive information.

OWASP Cheat Sheets

• Error Handling (opens in a new tab)
• Logging (opens in a new tab)
• Authorization (opens in a new tab)

OWASP ASVS 4.0.3

• V8.3.4 (opens in a new tab)
• V14.3.3 (opens in a new tab)
• V7.3.3 (opens in a new tab)

Attack patterns

• Choosing Message Identifier (opens in a new tab)
• Exploiting Incorrectly Configured SSL/TLS (opens in a new tab)
• WiFi MAC Address Tracking (opens in a new tab)
• WiFi SSID Tracking (opens in a new tab)
• Cellular Broadcast Message Request (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

OWASP Cheat Sheets

• XML Security (opens in a new tab)
• REST Security (opens in a new tab)
• JSON Web Token for Java (opens in a new tab)
• REST Assessment (opens in a new tab)
• Cross-Site Request Forgery Prevention (opens in a new tab)

OWASP ASVS 4.0.3

• V13.3.2 (opens in a new tab)
• V3.5.3 (opens in a new tab)
• V13.2.6 (opens in a new tab)

Attack patterns

• Padding Oracle Crypto Attack (opens in a new tab)
• Signature Spoofing by Improper Validation (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Requirements

   Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.

2. Architecture and Design

   Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.

3. Architecture and Design

   Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended.

OWASP Cheat Sheets

• Abuse Case (opens in a new tab)

OWASP ASVS 4.0.3

• V8.1.4 (opens in a new tab)
• V13.4.1 (opens in a new tab)
• V11.1.4 (opens in a new tab)

Attack patterns

• XML Ping of the Death (opens in a new tab)
• Exponential Data Expansion (opens in a new tab)
• Serialized Data Parameter Blowup (opens in a new tab)
• Serialized Data with Nested Payloads (opens in a new tab)
• Oversized Serialized Data Payloads (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Implementation

   Do not use user-controlled data for loop conditions.

2. Implementation

   Perform input validation.

OWASP Cheat Sheets

• XML Security (opens in a new tab)
• Mass Assignment (opens in a new tab)

OWASP ASVS 4.0.3

• V13.3.1 (opens in a new tab)
• V5.1.4 (opens in a new tab)
• V5.1.3 (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Implementation · Input Validation

   Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.

2. Architecture and Design · Language Selection

   Use a language that provides appropriate memory abstractions.

OWASP Cheat Sheets

• XML Security (opens in a new tab)
• Mass Assignment (opens in a new tab)

OWASP ASVS 4.0.3

• V13.3.1 (opens in a new tab)
• V5.1.4 (opens in a new tab)
• V5.1.3 (opens in a new tab)

Attack patterns

• Overread Buffers (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Requirements · Language Selection

   Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

2. Architecture and Design · Libraries or Frameworks

   Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

3. Operation · Build and Compilation · Environment Hardening

   Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index…

OWASP Cheat Sheets

• XML Security (opens in a new tab)
• Mass Assignment (opens in a new tab)

OWASP ASVS 4.0.3

• V13.3.1 (opens in a new tab)
• V5.1.4 (opens in a new tab)
• V5.1.3 (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Requirements · Language Selection

   Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

2. Implementation

   It is good practice to be responsible for freeing all resources you allocate and to be consistent with how and where you free resources in a function. If you allocate resources that you intend to free upon completion of the function, you must be sure to free the resources at all exit points for that function including…

3. Operation · Architecture and Design · Resource Limitation

   Use resource-limiting settings provided by the operating system or environment. For example, when managing system resources in POSIX, setrlimit() can be used to set limits for certain types of resources, and getrlimit() can determine how many resources are available.

Attack patterns

• HTTP DoS (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Requirements

   Choose a language that is not susceptible to these issues.

2. Implementation

   All calculated values that are used as index or for pointer arithmetic should be validated to ensure that they are within an expected range.

OWASP Cheat Sheets

• XML Security (opens in a new tab)
• Mass Assignment (opens in a new tab)

OWASP ASVS 4.0.3

• V13.3.1 (opens in a new tab)
• V5.1.4 (opens in a new tab)
• V5.1.3 (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Implementation

   Change the code's logic so that the resource is only closed once. This might require simplifying or refactoring. This fix can be simple to do in small code blocks, but more difficult when multiple closes are buried within complex conditionals.

2. Implementation · Refactoring

   It can be effective to implement a flag that is (1) set when the resource is opened, (2) cleared when it is closed, and (3) checked before closing. This approach can be useful when there are disparate cases in which closes must be performed.

3. Implementation · Refactoring

   When closing a resource, set the resource's associated variable to NULL or equivalent value for the given language. Some APIs will ignore this null value without causing errors.

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Implementation

   For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished.

2. Requirements

   Select a programming language that is not susceptible to these issues.

3. Implementation

   Check the results of all functions that return a value and verify that the value is non-null before acting upon it.

OWASP Cheat Sheets

• Logging (opens in a new tab)
• Error Handling (opens in a new tab)

OWASP ASVS 4.0.3

• V11.1.7 (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

OWASP Cheat Sheets

• File Upload (opens in a new tab)

OWASP ASVS 4.0.3

• V12.1.2 (opens in a new tab)
• V12.1.1 (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Implementation

   Only call matching memory management functions. Do not mix and match routines. For example, when you allocate a buffer with malloc(), dispose of the original pointer with free().

2. Implementation

   When programming in C++, consider using smart pointers provided by the boost library to help correctly and consistently manage memory.

3. Architecture and Design · Libraries or Frameworks

   Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Implementation

   Explicitly initialize the resource before use. If this is performed through an API function or standard procedure, follow all required steps.

2. Implementation

   Pay close attention to complex conditionals that affect initialization, since some branches might not perform the initialization.

3. Implementation

   Avoid race conditions (CWE-362) during initialization routines.

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Implementation

   The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.

2. Implementation

   When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.

3. Architecture and Design

   Limit the interleaving of operations on files from multiple processes.

OWASP Cheat Sheets

• Abuse Case (opens in a new tab)

OWASP ASVS 4.0.3

• V1.11.3 (opens in a new tab)
• V11.1.6 (opens in a new tab)
• V1.11.2 (opens in a new tab)

Attack patterns

• Leveraging Race Conditions via Symbolic Links (opens in a new tab)
• Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).