Hardware Security Vulnerabilities

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114

"""
CVSS v3.1 Score Calculation Example
 
This demonstrates the scoring methodology, not a complete implementation.
For production use, use established libraries like cvsslib.
"""
 
from enum import Enum
from typing import NamedTuple
 
class AttackVector(Enum):
    NETWORK = 0.85
    ADJACENT = 0.62
    LOCAL = 0.55
    PHYSICAL = 0.20
 
class AttackComplexity(Enum):
    LOW = 0.77
    HIGH = 0.44
 
class PrivilegesRequired(Enum):
    NONE = 0.85
    LOW = 0.62  # Or 0.68 if Scope Changed
    HIGH = 0.27  # Or 0.50 if Scope Changed
 
class UserInteraction(Enum):
    NONE = 0.85
    REQUIRED = 0.62
 
class Impact(Enum):
    NONE = 0.0
    LOW = 0.22
    HIGH = 0.56
 
class CVSSv31Score(NamedTuple):
    """Calculate CVSS v3.1 Base Score"""
    
    attack_vector: AttackVector
    attack_complexity: AttackComplexity
    privileges_required: PrivilegesRequired
    user_interaction: UserInteraction
    scope_changed: bool
    confidentiality_impact: Impact
    integrity_impact: Impact
    availability_impact: Impact
    
    def exploitability_score(self) -> float:
        """Calculate Exploitability sub-score"""
        return (8.22 * 
                self.attack_vector.value * 
                self.attack_complexity.value *
                self.privileges_required.value * 
                self.user_interaction.value)
    
    def impact_score(self) -> float:
        """Calculate Impact sub-score"""
        # Impact Sub Score (ISS)
        iss = 1 - (
            (1 - self.confidentiality_impact.value) *
            (1 - self.integrity_impact.value) *
            (1 - self.availability_impact.value)
        )
        
        if self.scope_changed:
            return 7.52 * (iss - 0.029) - 3.25 * (iss - 0.02) ** 15
        else:
            return 6.42 * iss
    
    def base_score(self) -> float:
        """Calculate final Base Score (0.0 - 10.0)"""
        impact = self.impact_score()
        
        if impact <= 0:
            return 0.0
        
        exploitability = self.exploitability_score()
        
        if self.scope_changed:
            score = min(1.08 * (impact + exploitability), 10.0)
        else:
            score = min(impact + exploitability, 10.0)
        
        # Round up to nearest 0.1
        return round(score * 10) / 10
 
# Example: Meltdown (CVE-2017-5754)
meltdown = CVSSv31Score(
    attack_vector=AttackVector.LOCAL,
    attack_complexity=AttackComplexity.LOW,
    privileges_required=PrivilegesRequired.LOW,
    user_interaction=UserInteraction.NONE,
    scope_changed=True,  # Impacts resources beyond its scope
    confidentiality_impact=Impact.HIGH,
    integrity_impact=Impact.NONE,
    availability_impact=Impact.NONE
)
 
print(f"Meltdown CVSS Score: {meltdown.base_score()}")
# Output: Meltdown CVSS Score: 5.6 (officially rated 5.6 by NVD)
 
# Example: Log4Shell (CVE-2021-44228)
log4shell = CVSSv31Score(
    attack_vector=AttackVector.NETWORK,
    attack_complexity=AttackComplexity.LOW,
    privileges_required=PrivilegesRequired.NONE,
    user_interaction=UserInteraction.NONE,
    scope_changed=True,
    confidentiality_impact=Impact.HIGH,
    integrity_impact=Impact.HIGH,
    availability_impact=Impact.HIGH
)
 
print(f"Log4Shell CVSS Score: {log4shell.base_score()}")
# Output: Log4Shell CVSS Score: 10.0

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95

/*
 * Example: Security Patch for CVE-2022-XXXXX
 * Integer Overflow in Buffer Calculation
 * 
 * This demonstrates the structure of a well-documented security patch.
 */
 
/*
 * VULNERABLE CODE (before patch):
 * 
 * The size calculation can overflow if 'count' is very large,
 * leading to a small allocation and subsequent buffer overflow.
 */
#ifdef SHOW_VULNERABLE_CODE
void* allocate_entries_vulnerable(unsigned int count) {
    size_t size = count * sizeof(struct entry);  // OVERFLOW POSSIBLE!
    void* buffer = malloc(size);
    return buffer;
}
#endif
 
/*
 * PATCHED CODE:
 * 
 * CVE-2022-XXXXX: Integer overflow in entry allocation
 * 
 * Fix: Check for overflow before performing multiplication.
 * Use helper macro that returns 0 on overflow.
 * 
 * Reported-by: Security Researcher <researcher@example.com>
 * Signed-off-by: Kernel Developer <dev@example.com>
 * CC: stable@kernel.org
 * Fixes: abc123def456 ("Add entry allocation function")
 */
 
#include <limits.h>
 
/* Safe multiplication that returns 0 on overflow */
static inline size_t safe_mul(size_t a, size_t b) {
    if (a != 0 && b > SIZE_MAX / a) {
        return 0;  /* Would overflow */
    }
    return a * b;
}
 
void* allocate_entries_secure(unsigned int count) {
    size_t size;
    void* buffer;
    
    /* Calculate size with overflow protection */
    size = safe_mul((size_t)count, sizeof(struct entry));
    if (size == 0 && count != 0) {
        /* Overflow detected */
        return NULL;
    }
    
    /* 
     * Additional validation: limit maximum allocation
     * to prevent DoS via memory exhaustion
     */
    if (size > MAX_ENTRY_ALLOCATION) {
        return NULL;
    }
    
    buffer = malloc(size);
    return buffer;
}
 
/*
 * Patch Metadata (in commit message):
 * 
 * subject: fix integer overflow in entry allocation
 * 
 * body:
 *   The size calculation in allocate_entries() did not check for
 *   integer overflow when multiplying count by sizeof(struct entry).
 *   
 *   A malicious user could trigger an overflow by specifying a large
 *   count value, resulting in a small allocation. Subsequent writes
 *   to the buffer would then overflow, potentially allowing arbitrary
 *   code execution.
 *   
 *   Fix this by using safe_mul() which returns 0 on overflow, and
 *   adding a maximum size check to prevent memory exhaustion attacks.
 *   
 *   Impact: High - Potential RCE from authenticated user
 *   CVSS: 7.8 (Local, Low complexity, Low priv, High impact)
 *   
 * tags:
 *   Fixes: abc123def456 ("Add entry allocation function")
 *   Cc: stable@kernel.org  # Backport to stable kernels
 *   Reported-by: Security Researcher
 *   Reviewed-by: Security Team Member
 *   Tested-by: QA Team
 */

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114

#!/bin/bash
# Comprehensive Linux Security Update Management
 
echo "=== Security Update Status ==="
echo ""
 
# Detect distribution
if [ -f /etc/debian_version ]; then
    DISTRO="debian"
    PKG_MGR="apt"
elif [ -f /etc/redhat-release ]; then
    DISTRO="rhel"
    PKG_MGR="dnf"
else
    echo "Unsupported distribution"
    exit 1
fi
 
# Check for available security updates
case $PKG_MGR in
    apt)
        echo "Available security updates (Debian/Ubuntu):"
        sudo apt update -qq
        apt list --upgradable 2>/dev/null | grep -i security
        
        # Count pending security updates
        SEC_UPDATES=$(apt list --upgradable 2>/dev/null | grep -c security)
        echo ""
        echo "Total security updates pending: $SEC_UPDATES"
        
        # Check if reboot required
        if [ -f /var/run/reboot-required ]; then
            echo ""
            echo "⚠️  REBOOT REQUIRED for security updates to take effect"
            cat /var/run/reboot-required.pkgs 2>/dev/null
        fi
        
        # Check kernel version vs running version
        INSTALLED=$(dpkg -l linux-image-* | grep ^ii | tail -1 | awk '{print $2}')
        RUNNING="linux-image-$(uname -r)"
        if [ "$INSTALLED" != "$RUNNING" ]; then
            echo ""
            echo "⚠️  New kernel installed but not running"
            echo "   Currently: $RUNNING"
            echo "   Installed: $INSTALLED"
        fi
        ;;
        
    dnf)
        echo "Available security updates (RHEL/Fedora):"
        sudo dnf updateinfo list sec 2>/dev/null
        
        # Detailed security advisory info
        echo ""
        echo "Security advisories summary:"
        sudo dnf updateinfo summary sec
        
        # Check for kernel updates requiring reboot
        RUNNING_KERNEL=$(uname -r)
        LATEST_KERNEL=$(rpm -q kernel --last | head -1 | awk '{print $1}' | sed 's/kernel-//')
        if [ "$RUNNING_KERNEL" != "$LATEST_KERNEL" ]; then
            echo ""
            echo "⚠️  New kernel available but not running"
            echo "   Currently: $RUNNING_KERNEL"
            echo "   Latest:    $LATEST_KERNEL"
        fi
        ;;
esac
 
echo ""
echo "=== Automatic Update Configuration ==="
 
case $PKG_MGR in
    apt)
        echo "Unattended-upgrades status:"
        if dpkg -l unattended-upgrades &>/dev/null; then
            echo "✓ unattended-upgrades is installed"
            echo "Configuration:"
            grep -E '^[^#]' /etc/apt/apt.conf.d/50unattended-upgrades | head -10
        else
            echo "✗ unattended-upgrades not installed"
            echo "  Install with: sudo apt install unattended-upgrades"
        fi
        ;;
        
    dnf)
        echo "DNF Automatic status:"
        if systemctl is-enabled dnf-automatic.timer &>/dev/null; then
            echo "✓ dnf-automatic is enabled"
            systemctl status dnf-automatic.timer --no-pager | head -5
        else
            echo "✗ dnf-automatic not enabled"
            echo "  Enable with: systemctl enable --now dnf-automatic.timer"
        fi
        ;;
esac
 
echo ""
echo "=== Microcode Update Status ==="
echo "CPU: $(grep -m1 'model name' /proc/cpuinfo | cut -d: -f2 | xargs)"
echo "Current microcode: $(grep -m1 'microcode' /proc/cpuinfo | cut -d: -f2 | xargs)"
 
# Check for microcode package
case $DISTRO in
    debian)
        INTEL=$(dpkg -l intel-microcode 2>/dev/null | grep ^ii)
        AMD=$(dpkg -l amd64-microcode 2>/dev/null | grep ^ii)
        ;;
    rhel)
        INTEL=$(rpm -q microcode_ctl 2>/dev/null)
        AMD=$(rpm -q microcode_ctl 2>/dev/null)
        ;;
esac
echo "Microcode package: ${INTEL:- Not installed} ${ AMD: -}"

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63

# Emergency Security Incident Response Checklist
 
## Initial Detection
- [ ] Verify vulnerability report source is credible
- [ ] Confirm CVE or advisory identifier
- [ ] Read vendor security advisory completely
- [ ] Check CVSS score and attack vector
- [ ] Review proof-of-concept (PoC) if available
 
## Impact Assessment
- [ ] Inventory all affected systems
  - [ ] Production servers
  - [ ] Development/staging
  - [ ] Employee workstations
  - [ ] Cloud resources
  - [ ] Container images
- [ ] Determine which systems are internet-exposed
- [ ] Check if exploit is observed in the wild
- [ ] Assess business criticality of affected systems
 
## Immediate Mitigations
Before patch is available or tested:
- [ ] Implement WAF/IDS rules if applicable
- [ ] Block vulnerable ports/protocols at firewall
- [ ] Disable affected feature if possible
- [ ] Implement additional authentication controls
- [ ] Increase logging detail on affected systems
- [ ] Alert SOC/monitoring for exploit signatures
 
## Patch Deployment
- [ ] Download patches from verified sources
- [ ] Verify patch authenticity (signatures/hashes)
- [ ] Test in isolated staging environment
  - [ ] Verify vulnerability is fixed
  - [ ] Run regression test suite
  - [ ] Test critical application functionality
- [ ] Create rollback procedure
- [ ] Deploy to production with monitoring
  - [ ] Use phased rollout if possible
  - [ ] Have rollback ready
  - [ ] Monitor error rates and performance
- [ ] Verify deployment completed all systems
 
## Verification
- [ ] Rescan environment for vulnerability
- [ ] Confirm affected systems show new patch version
- [ ] Verify no signs of prior compromise
- [ ] Test that protected functionality works correctly
 
## Documentation
- [ ] Record timeline of response
- [ ] Document all systems patched
- [ ] Note any systems that couldn't be patched (with justification)
- [ ] Create exceptions for delayed patching with compensating controls
- [ ] Update asset inventory if gaps found
 
## Post-Incident Review
- [ ] Conduct blameless post-mortem
- [ ] Identify what went well
- [ ] Identify what could be improved
- [ ] Update runbooks and procedures
- [ ] Consider architectural changes to reduce future exposure
- [ ] Share learnings with broader organization

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124

"""
Patch Compliance Reporting Example
 
This demonstrates the kinds of metrics organizations track
for patch management programs.
"""
 
from dataclasses import dataclass
from datetime import datetime, timedelta
from typing import List, Dict
import json
 
@dataclass
class Vulnerability:
    cve_id: str
    cvss_score: float
    severity: str  # Critical, High, Medium, Low
    published_date: datetime
    patch_available_date: datetime
    exploited_in_wild: bool
 
@dataclass
class Asset:
    hostname: str
    asset_type: str  # server, workstation, container
    internet_facing: bool
    vulnerabilities: List[Vulnerability]
    patched_date: Dict[str, datetime]  # CVE -> patch date
 
class PatchComplianceReport:
    """Generate patch compliance metrics for executive reporting."""
    
    def __init__(self, assets: List[Asset], sla_days: Dict[str, int]):
        self.assets = assets
        self.sla_days = sla_days  # e.g., {'Critical': 2, 'High': 7}
    
    def calculate_compliance(self) -> Dict:
        """Calculate overall patch compliance metrics."""
        
        total_vulns = 0
        patched_vulns = 0
        overdue_vulns = 0
        mean_time_to_patch_days = []
        
        for asset in self.assets:
            for vuln in asset.vulnerabilities:
                total_vulns += 1
                
                if vuln.cve_id in asset.patched_date:
                    patched_vulns += 1
                    
                    # Calculate time to patch
                    ttp = (asset.patched_date[vuln.cve_id] - 
                           vuln.patch_available_date).days
                    mean_time_to_patch_days.append(ttp)
                    
                    # Check if patched within SLA
                    sla = self.sla_days.get(vuln.severity, 30)
                    if ttp > sla:
                        overdue_vulns += 1
                else:
                    # Not yet patched
                    age = (datetime.now() - vuln.patch_available_date).days
                    sla = self.sla_days.get(vuln.severity, 30)
                    if age > sla:
                        overdue_vulns += 1
        
        mttp = sum(mean_time_to_patch_days) / len(mean_time_to_patch_days) \
               if mean_time_to_patch_days else 0
        
        return {
            'total_vulnerabilities': total_vulns,
            'patched_vulnerabilities': patched_vulns,
            'patch_rate': patched_vulns / total_vulns * 100 if total_vulns else 100,
            'overdue_vulnerabilities': overdue_vulns,
            'sla_compliance': (total_vulns - overdue_vulns) / total_vulns * 100 
                              if total_vulns else 100,
            'mean_time_to_patch_days': round(mttp, 1),
            'assets_scanned': len(self.assets),
        }
    
    def critical_exposures(self) -> List[Dict]:
        """List critical/high vulns on internet-facing assets."""
        
        exposures = []
        for asset in self.assets:
            if not asset.internet_facing:
                continue
            
            for vuln in asset.vulnerabilities:
                if vuln.severity in ['Critical', 'High']:
                    if vuln.cve_id not in asset.patched_date:
                        exposures.append({
                            'hostname': asset.hostname,
                            'cve': vuln.cve_id,
                            'cvss': vuln.cvss_score,
                            'exploited': vuln.exploited_in_wild,
                            'days_exposed': (datetime.now() - 
                                           vuln.patch_available_date).days
                        })
        
        # Sort by exploited status and age
        exposures.sort(key=lambda x: (-x['exploited'], -x['days_exposed']))
        return exposures
 
# Example usage
if __name__ == "__main__":
    # Sample data
    sla = {
        'Critical': 2,   # 2 days  
        'High': 7,       # 7 days
        'Medium': 30,    # 30 days
        'Low': 90        # 90 days
    }
    
    report = PatchComplianceReport(assets=[], sla_days=sla)
    metrics = report.calculate_compliance()
    
    print("=== Patch Compliance Report ===")
    print(f"Total Vulnerabilities: {metrics['total_vulnerabilities']}")
    print(f"Patch Rate: {metrics['patch_rate']:.1f}%")
    print(f"SLA Compliance: {metrics['sla_compliance']:.1f}%")
    print(f"Mean Time to Patch: {metrics['mean_time_to_patch_days']} days")
    print(f"Overdue Patches: {metrics['overdue_vulnerabilities']}")