Security Research Posts — Vulnerability Disclosures, Assembly & Network Protocols

ArubaOS 8.13.2.0 does not validate ICMP Echo Request source IPs against MAC/IP bindings or apply uRPF — attacker MAC with victim IP is accepted and replied to (CWE-290). Broadcast source IP (192.168.56.255) causes the controller to reply to ff:ff:ff:ff:ff:ff, delivering the reply to every host on the L2 segment (CWE-406). Two-machine evidence: Parrot OS attacker sends spoofed request, Windows victim receives unsolicited Echo Reply id=0xc101 confirmed in independent pcap. No ICMP request was sent from the victim. RFC 1122 §3.2.2.6 violation. Bugcrowd closed as expected behavior. No fix issued.

UDP DNS is stateful in practice: recursive resolvers hold per-query client tables, delegation chain depth counters, DNSSEC validation state, and TCP connection pools for DoT/DoH. Each layer is exhaustible at different cost ratios. Water torture generates maximum valid NXDOMAIN workload at minimum bandwidth. NXNS amplification (CVE-2020-8616) forces resolver delegation storms via NS referrals. TsuNAME creates infinite cyclic delegation. NRDelegation combines both. Full BIND9/Unbound configuration hardening and rate-limiting defense included.

The ‘65536 port limit’ framing is wrong — Linux TCP capacity is governed by 4-tuple uniqueness (src_ip:src_port:dst_ip:dst_port) and ip_conntrack_max. TIME_WAIT exhaustion holds sockets in 2MSL timeout, consuming conntrack entries. Sockstress sets TCP window=0 to trigger infinite Persist Timer loops, stalling server state machines with minimal bandwidth. Slowloris-class variants do the same at L7. Full kernel parameter analysis: tcp_tw_reuse, tcp_fin_timeout, conntrack_max, and per-attack mitigation.

BYOVD loads a signed vulnerable driver, exploits it for arbitrary kernel R/W, and terminates EDR at Ring 0 — Windows-only, noisy at driver load time, requires admin. User-space injection (Phantom Evasion Loader) uses SROP frames via sys_rt_sigreturn to fire ptrace without a direct ptrace syscall sequence, writes payload in a single process_vm_writev call (syscall 311), redirects RIP into target process — implant runs inside cron’s address space with cron’s identity. Linux-only. Results: 0/65 VirusTotal static, SROP and process_vm_writev invisible to Hatching Triage behavioral sandbox, only ptrace attach entry detected.

MAX_LFS_FILESIZE only gates the superblock. A poisoned FUSE_GETATTR reply mutates i_size to UINT64_MAX at runtime. The (pos + count - 1) » PAGE_SHIFT arithmetic wraps unsigned, kworker loops become infinite, and vma_merge() degenerates into an arbitrary OOB-write on Maple Tree-backed kernels. Full mm/ subsystem analysis: filemap.c, mmap.c, XArray walk corruption primitives.

struct fuse_req holds inode references without bumping i_count. SIGKILL a stalled reader, trigger drop_caches inode eviction, delay fuse_abort_conn — the freed slab slot gets reallocated as struct cred. The race delivers a refcount double-decrement on whatever credential lands there: full DirtyCred-class LPE primitive. Complete race window analysis, SLUB reallocation timing, and RCU lifetime breakdown.