@blamejs/exceptd-skills 0.21.5 → 0.21.7

package/data/framework-control-gaps.json

@@ -1227,6 +1227,7 @@
       "CVE-2021-1871",
       "CVE-2021-1879",
       "CVE-2021-20016",
+      "CVE-2021-20022",
       "CVE-2021-20028",
       "CVE-2021-20035",
       "CVE-2021-20038",
@@ -1338,6 +1339,7 @@
       "CVE-2021-38163",
       "CVE-2021-38371",
       "CVE-2021-38406",
+      "CVE-2021-38645",
       "CVE-2021-38647",
       "CVE-2021-38648",
       "CVE-2021-38649",
@@ -3294,6 +3296,7 @@
       "CVE-2020-5410",
       "CVE-2020-7961",
       "CVE-2021-1497",
+      "CVE-2021-20022",
       "CVE-2021-21315",
       "CVE-2021-22502",
       "CVE-2021-25370",
@@ -3883,6 +3886,7 @@
       "CVE-2021-1870",
       "CVE-2021-1871",
       "CVE-2021-1879",
+      "CVE-2021-1905",
       "CVE-2021-20016",
       "CVE-2021-20028",
       "CVE-2021-20035",
@@ -3905,6 +3909,7 @@
       "CVE-2021-22555",
       "CVE-2021-22600",
       "CVE-2021-22681",
+      "CVE-2021-22893",
       "CVE-2021-22941",
       "CVE-2021-22986",
       "CVE-2021-23758",
@@ -3984,6 +3989,7 @@
       "CVE-2021-38163",
       "CVE-2021-38371",
       "CVE-2021-38406",
+      "CVE-2021-38645",
       "CVE-2021-38647",
       "CVE-2021-38648",
       "CVE-2021-38649",
@@ -5265,6 +5271,7 @@
       "CVE-2021-1789",
       "CVE-2021-1871",
       "CVE-2021-1879",
+      "CVE-2021-1905",
       "CVE-2021-20016",
       "CVE-2021-20028",
       "CVE-2021-21148",
@@ -5274,6 +5281,7 @@
       "CVE-2021-21224",
       "CVE-2021-22555",
       "CVE-2021-22600",
+      "CVE-2021-22893",
       "CVE-2021-22941",
       "CVE-2021-22986",
       "CVE-2021-25370",
@@ -5325,6 +5333,7 @@
       "CVE-2021-36948",
       "CVE-2021-38000",
       "CVE-2021-38163",
+      "CVE-2021-38645",
       "CVE-2021-38646",
       "CVE-2021-38648",
       "CVE-2021-38649",
@@ -6238,6 +6247,7 @@
       "CVE-2020-0986",
       "CVE-2020-17087",
       "CVE-2021-1782",
+      "CVE-2021-1905",
       "CVE-2021-22600",
       "CVE-2021-25370",
       "CVE-2021-28664",
@@ -6670,6 +6680,7 @@
       "CVE-2020-7247",
       "CVE-2020-7961",
       "CVE-2021-1497",
+      "CVE-2021-20022",
       "CVE-2021-22204",
       "CVE-2021-22205",
       "CVE-2021-22502",
@@ -7297,6 +7308,7 @@
       "CVE-2021-22555",
       "CVE-2021-22600",
       "CVE-2021-22681",
+      "CVE-2021-22893",
       "CVE-2021-22941",
       "CVE-2021-22986",
       "CVE-2021-23758",
@@ -7368,6 +7380,7 @@
       "CVE-2021-38163",
       "CVE-2021-38371",
       "CVE-2021-38406",
+      "CVE-2021-38645",
       "CVE-2021-38646",
       "CVE-2021-38648",
       "CVE-2021-38649",
@@ -9644,6 +9657,7 @@
       "CVE-2021-1048",
       "CVE-2021-21224",
       "CVE-2021-21551",
+      "CVE-2021-22893",
       "CVE-2021-22991",
       "CVE-2021-27102",
       "CVE-2021-30869",
@@ -11740,6 +11754,7 @@
       "CVE-2021-3493",
       "CVE-2021-3560",
       "CVE-2021-36934",
+      "CVE-2021-38645",
       "CVE-2021-38648",
       "CVE-2021-38649",
       "CVE-2021-4034",
@@ -12798,7 +12813,9 @@
       "CVE-2021-1789",
       "CVE-2021-1870",
       "CVE-2021-1879",
+      "CVE-2021-1905",
       "CVE-2021-20016",
+      "CVE-2021-20022",
       "CVE-2021-20028",
       "CVE-2021-20035",
       "CVE-2021-20090",
@@ -12895,6 +12912,7 @@
       "CVE-2021-38163",
       "CVE-2021-38371",
       "CVE-2021-38406",
+      "CVE-2021-38645",
       "CVE-2021-38646",
       "CVE-2021-38647",
       "CVE-2021-38649",
@@ -13693,6 +13711,7 @@
       "CVE-2020-2555",
       "CVE-2020-8644",
       "CVE-2021-20021",
+      "CVE-2021-22893",
       "CVE-2021-33044",
       "CVE-2021-33045",
       "CVE-2021-34473",
@@ -14458,6 +14477,7 @@
       "CVE-2020-8195",
       "CVE-2020-8196",
       "CVE-2021-20021",
+      "CVE-2021-20022",
       "CVE-2021-20035",
       "CVE-2021-20123",
       "CVE-2021-20124",
@@ -14854,12 +14874,15 @@
     "misses": [
       "Software that updates itself (browsers, agents, desktop applications, device firmware) fetches and applies updates outside any centralised system, so the integrity check the control requires never runs on those updates",
       "Integrity is usually taken to mean the vendor's signature verified, which does not detect a signed update from a compromised build system or a rollback to an older signed build",
-      "Confirmation that an update applied records the installed version, not that the binary running matches what the vendor published"
+      "Confirmation that an update applied records the installed version, not that the binary running matches what the vendor published",
+      "Confirmation that an update applied does not show that it carries the fix for a given vulnerability: an Android device can apply its monthly update successfully and report a security patch level that the vendor's bulletin does not list the fix under"
     ],
-    "real_requirement": "Update integrity evidence must cover self-updating software as well as centrally patched software: signature verification before apply, pinning of the update signing key out of band, rejection of rollbacks to older signed builds, and a post-install check that the running binary matches the published artifact.",
+    "real_requirement": "Update integrity evidence must cover self-updating software as well as centrally patched software: signature verification before apply, pinning of the update signing key out of band, rejection of rollbacks to older signed builds, and a post-install check that the running binary matches the published artifact. For each vulnerability being remediated, the evidence must also show that the installed build or security patch level is one the vendor lists the fix under, not only that an update applied.",
     "status": "open",
     "opened_date": "2026-09-22",
-    "evidence_cves": [],
+    "evidence_cves": [
+      "CVE-2021-1905"
+    ],
     "atlas_refs": [],
     "attack_refs": [
       "T1195.002",
@@ -14867,16 +14890,15 @@
     ],
     "theater_test": {
       "claim": "Our patches and updates keep their integrity and are confirmed applied, which satisfies ISM-0298.",
-      "test": "List the software on a sample host that updates itself outside the central patching system. For each, confirm the update client verifies a signature before applying, rejects a rollback to an older signed build, and that someone can show the installed binary matches the vendor's published artifact. Theater verdict if the evidence covers only centrally deployed patches, or if any self-updating product has no documented integrity check.",
+      "test": "List the software on a sample host that updates itself outside the central patching system. For each, confirm the update client verifies a signature before applying, rejects a rollback to an older signed build, and that someone can show the installed binary matches the vendor's published artifact. Then pick one remediated CVE and confirm the record shows an installed build or security patch level that the vendor lists its fix under. Theater verdict if the evidence covers only centrally deployed patches, if any self-updating product has no documented integrity check, or if the remediated CVE is recorded as fixed on the strength of an applied update alone.",
       "evidence_required": [
         "inventory of self-updating software on a sampled host",
         "per-product record of signature verification and rollback protection",
-        "post-install artifact comparison for one sampled update"
+        "post-install artifact comparison for one sampled update",
+        "for one remediated CVE, the installed build or security patch level compared with the level the vendor lists its fix under"
       ],
       "verdict_when_failed": "compliance-theater"
-    },
-    "forward_looking": true,
-    "forward_looking_reason": "No CVE in the catalog anchors this gap yet; it records the control class without binding it to a single incident."
+    }
   },
   "AU-ISM-1240": {
     "framework": "Australian Government Information Security Manual (ISM)",

package/data/zeroday-lessons.json

@@ -17,7 +17,7 @@
       "rebuild_after_days": 365,
       "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
     },
-    "entry_count": 1754
+    "entry_count": 1758
   },
   "CVE-2026-31431": {
     "name": "Copy Fail",
@@ -28139,7 +28139,7 @@
     ]
   },
   "CVE-2025-27038": {
-    "name": "Qualcomm Multiple Chipsets Use-After-Free Vulnerability",
+    "name": "Qualcomm Multiple Chipsets Use-After-Free Vulnerability (CVE-2025-27038)",
     "lesson_date": "2026-05-29",
     "attack_vector": {
       "description": "a use-after-free (CWE-416) in the Qualcomm Adreno GPU driver, exploited by a local foothold to escalate privilege on the device. CISA KEV-listed 2025-06-03 with confirmed in-the-wild exploitation; LPEs of this class are routinely paired with an initial-access primitive.",
@@ -145457,5 +145457,345 @@
         ]
       }
     ]
+  },
+  "CVE-2021-22893": {
+    "name": "Ivanti Pulse Connect Secure Use-After-Free Vulnerability",
+    "lesson_date": "2026-09-23",
+    "ai_discovered_zeroday": false,
+    "ai_discovery_source": "vendor_research",
+    "ai_discovery_date": null,
+    "ai_assist_factor": "none",
+    "attack_vector": {
+      "description": "A crafted request to the Pulse Connect Secure license-server handling endpoints triggers a use-after-free that runs code as root on the gateway. The endpoints are present regardless of whether the license-server role is set, so the flaw is reachable without authentication and, combined with the Windows File Share Browser and Pulse Secure Collaboration features, forms an authentication bypass to remote code execution.",
+      "privileges_required": "none; the flaw is reachable by an unauthenticated remote attacker",
+      "complexity": "low; exploited in the wild as a zero-day before a fix existed",
+      "ai_factor": "None. Found during an incident investigation; no source claims AI tooling."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Upgrading to Pulse Connect Secure 9.1R11.4 after running the Integrity Checker Tool, and before the fix existed importing the vendor Workaround-2104.xml or restricting source addresses to the gateway",
+        "was_this_required": true,
+        "framework_requiring_it": "NIS2-Art21-patch-management",
+        "adequacy": "The 9.1R11.4 upgrade removes the flaw, but as a zero-day exploited before any fix the only pre-patch protection was the vendor XML mitigation and source-address restriction, which reduce but do not eliminate reach for a license-server deployment."
+      },
+      "detection": {
+        "what_would_have_worked": "Enabling the Unauthenticated Requests log, shipping it to an off-device collector, and running the Integrity Checker Tool to flag modified appliance files",
+        "was_this_required": false,
+        "framework_requiring_it": "UK-CAF-C1",
+        "adequacy": "These signals catch the request and the file modifications, but the appliance does not log unauthenticated requests by default and the actor cleared on-device logs, so detection depends on both being configured before the intrusion."
+      },
+      "response": {
+        "what_would_have_worked": "Treating an appliance on which the Integrity Checker Tool finds mismatches as compromised: isolating it with the power on, capturing memory and disk images with the vendor, factory-resetting it through the serial console, upgrading to 9.1R11.4, re-importing the saved configuration and changing the passwords of every account that passed through the gateway",
+        "was_this_required": false,
+        "framework_requiring_it": "ISO-27001-2022-A.8.8",
+        "adequacy": "Because the actor maintained persistence across upgrades, a patch alone does not recover a device compromised earlier; the factory reset and the password changes are the load-bearing steps."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false
+      },
+      "NIS2-Art21-patch-management": {
+        "covered": true,
+        "adequate": false
+      },
+      "UK-CAF-C1": {
+        "covered": true,
+        "adequate": false
+      },
+      "AU-ISM-1546": {
+        "covered": true,
+        "adequate": false
+      },
+      "ISO-27001-2022-A.8.8": {
+        "covered": true,
+        "adequate": false
+      }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-131",
+        "name": "PERIMETER-VPN-GATEWAY-AUTH-BYPASS-EXPEDITED-REMEDIATION",
+        "description": "A remote-access gateway that is itself the network authentication enforcement point has an authentication-bypass flaw remediated on a listing-tied expedited clock rather than the routine appliance patch window, with every reachable authentication path enumerated and interim reachability restricted until the fixed build is running.",
+        "evidence": "CVE-2021-22893 is a use-after-free reachable through a Pulse Connect Secure license-server handling endpoint that lets an unauthenticated attacker execute code with root privileges, and CERT/CC Vulnerability Note VU#213092 states that having the license server configured is not a prerequisite because the vulnerable endpoints are present regardless; the appliance is the network authentication enforcement point, so it warranted the expedited clock rather than the routine window the pre-patch zero-day period defeated.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "AU-ISM-1546",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-031",
+        "name": "FIREWALL-EGRESS-TELEMETRY-SEPARATE-TRUST-ZONE",
+        "description": "Trust-boundary network devices forward their access, threat and authentication logs to a collector held in a separate trust zone with an independent management plane, so the record survives when the device itself is taken over.",
+        "evidence": "Mandiant reports the actor cleared relevant log files on the Pulse Connect Secure appliance with a utility it tracks as THINBLOOD, and CISA alert AA21-110A documents further cleanup by timestomping and rm of temporary files; because CERT/CC notes exploitation of this unauthenticated flaw may be recorded only in the Unauthenticated Requests Log, forwarding the gateway's access and authentication logs to a collector in a separate trust zone would preserve evidence the device itself lost.",
+        "gap_closes": [
+          "UK-CAF-C1"
+        ]
+      }
+    ]
+  },
+  "CVE-2021-38645": {
+    "name": "Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability",
+    "lesson_date": "2026-09-23",
+    "ai_discovered_zeroday": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_date": null,
+    "ai_assist_factor": "none",
+    "attack_vector": {
+      "description": "A local low-privileged process connects to the world-writable omiserver.sock socket, poses as omiserver and sends the omiengine an authentication-success response with uid 0 and gid 0 for a client connection it also opened, so commands issued on that connection run as root.",
+      "privileges_required": "Any existing unprivileged local account on a Linux host running OMI below 1.6.8-1.",
+      "complexity": "Low per the CVSS vector (AC:L). Wiz describes the attack as answering before omiserver's real response and guessing the client's socket id, which it says is usually below 10. Wiz also says exploitation is quite complex and statistical, because a separate use-after-free in the same code path keeps crashing the omiengine.",
+      "ai_factor": "None. Reported to Microsoft by Wiz researchers; no source states that AI tooling was used to find or exploit the flaw."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Inventorying every OMI copy, including those installed by Azure VM extensions, on-premises Log Analytics agents, on-premises DSC nodes, Operations Manager, Azure Marketplace VM images, the Container Monitoring Solution image and HDInsight clusters, and moving each to its fixed build: OMI 1.6.8-1, OMS Agent for Linux GA v1.13.40-0, LAD v4.0.15 or v3.0.135, Linux DSC agent 2.71.1.25, 2.70.0.30 or 3.0.0.3, Azure Stack Hub extensions 1.14.02 and 3.1.135, the Container Monitoring Solution image sha256:12b7682d8f9a2f67752bf121029e315abcae89bc0c34a0e05f07baec72280707, and Microsoft's update script on HDInsight nodes that did not update automatically.",
+        "was_this_required": true,
+        "framework_requiring_it": "NIST-800-53-SI-2",
+        "adequacy": "The fixed builds close CVE-2021-38645 together with its three OMI siblings, but only on hosts where the inventory records OMI; a copy that Azure did not update automatically stays vulnerable until someone finds it."
+      },
+      "detection": {
+        "what_would_have_worked": "Collecting auditd execve records (AUOMS through the Syslog connector in Microsoft Sentinel) and alerting on any uid 0 process whose working directory is /var/opt/microsoft/scx/tmp, whichever of the ExecuteCommand, ExecuteShellCommand or ExecuteScript RunAs classes started it, or on a command line that runs a script from /etc/opt/microsoft/scx/conf/tmpdir/, similar to /bin/sh /etc/opt/microsoft/scx/conf/tmpdir/scx* (SCXcore deletes each such script as soon as it has run, so a later listing of that directory does not show it); enabling scxadmin verbose logging and searching scx.log for Invoke_Execute to capture entries from all three classes; and auditing connections to /var/opt/omi/run/omiserver.sock from accounts other than root and omi.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "The SCX signals show root command execution through the OMI providers, which follows any of the four OMI flaws, but the scx.log entries appear only after verbose logging is enabled and neither signal separates an attack from a scheduled management action. The socket audit is the signal closest to this local path, and it is a general heuristic rather than a published vendor rule."
+      },
+      "response": {
+        "what_would_have_worked": "Treating any host that ran OMI below 1.6.8-1 with untrusted local accounts as possibly compromised at root: reviewing SCX logs and auditd history for root commands issued through OMI, checking for persistence, and rotating credentials and keys stored on the host.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Updating OMI stops further use of the flaw but does not remove root access already obtained, so a host with untrusted local users needs the compromise review in addition to the package update."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "A process that matched Microsoft's advisory only as published on 2021-09-14 missed products added on 2021-09-16 and 2021-09-17, and the advisory does not list HDInsight clusters, whose manual update is given in Microsoft's separate guidance post."
+      },
+      "NIST-800-53-AC-6": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Least-privilege review of the VM's own accounts does not test the privilege boundary between omiengine and the root-running omiserver."
+      },
+      "NIS2-Art21-patch-management": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The reasonable-time requirement cannot be met for OMI copies that Azure did not update and the entity has not identified."
+      },
+      "UK-CAF-B4": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Closing the OMI ports counts as the OMI mitigation in an assessment while the local socket escalation stays open."
+      },
+      "AU-Essential-8-Patch": {
+        "covered": true,
+        "adequate": false,
+        "gap": "At Maturity Level One a non-listening or internally reachable OMI instance is an other application with no patch timeframe."
+      },
+      "ISO-27001-2022-A.8.8": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Marketplace VM images that Microsoft flagged through Service Health notifications and HDInsight clusters are not products in the advisory, so a register that lists the image or cluster rather than the OMI package has no advisory entry to match."
+      }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-021",
+        "name": "TIER-3-DEPENDENCY-INVENTORY",
+        "description": "The software inventory records every component that another product or platform agent installs on a host, with that component's own version, so that a bundled component is matched against advisories and patched on the same schedule as software the organization installed itself.",
+        "evidence": "OMI below 1.6.8-1 was installed on Linux VMs by Azure VM management extensions (the Log Analytics agent, the Linux Diagnostic extension and the DSC agent) and was also present in Operations Manager deployments, the Container Monitoring Solution image and HDInsight clusters, per Microsoft's September 2021 Additional Guidance post covering CVE-2021-38645. Wiz found over 65% of sampled Azure customers exposed and describes OMI's functions in Azure VMs as almost completely undocumented.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-patch-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-135",
+        "name": "CONTROL-PANEL-PLUGIN-USER-SURFACE-MUST-NOT-REACH-ROOT-OPERATIONS",
+        "description": "A privileged service that accepts requests from unprivileged local users must establish each request's identity from a source those users cannot forge, and a message arriving on an endpoint they can write must never set the privileges under which later requests run.",
+        "evidence": "In OMI below 1.6.8-1 any local user can write to /var/opt/omi/run/omiserver.sock, and Wiz's analysis of CVE-2021-38645 shows the omiengine handling messages from clients and from omiserver the same way, so a local process posing as omiserver can have a connection recorded as uid 0 and gid 0 and then run commands as root.",
+        "gap_closes": [
+          "NIST-800-53-AC-6",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-038",
+        "name": "MITIGATION-ACTIVE-PATCH-PENDING-VERDICT-CLASS",
+        "description": "A compliance verdict that credits a compensating measure names the specific flaws that measure blocks, and a host that relies on it for a flaw it does not block is recorded as unpatched for that flaw.",
+        "evidence": "Microsoft's Additional Guidance post offers restricting TCP 5985, 5986 and 1270 as protection against the remote-code-execution flaw CVE-2021-38647 only. CVE-2021-38645 runs over the local omiserver.sock socket, so a Linux host below OMI 1.6.8-1 with those ports closed can still be escalated to root and has to be recorded as unpatched for this CVE.",
+        "gap_closes": [
+          "UK-CAF-B4",
+          "ISO-27001-2022-A.8.8"
+        ]
+      }
+    ]
+  },
+  "CVE-2021-20022": {
+    "name": "SonicWall Email Security Unrestricted Upload of File Vulnerability",
+    "lesson_date": "2026-09-26",
+    "ai_discovered_zeroday": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_date": null,
+    "ai_assist_factor": "none",
+    "attack_vector": {
+      "description": "An attacker who holds an administrator session uploads a branding-package ZIP whose entries use directory-traversal paths; Email Security extracts them without confining them to the branding directory, writing a BEHINDER JSP web shell into a web-accessible Apache Tomcat directory. On the Windows installation Mandiant examined, the Tomcat process runs as NT AUTHORITY\\SYSTEM, so the web shell runs with those rights.",
+      "privileges_required": "an authenticated administrator session, which the chained CVE-2021-20021 authentication bypass supplies",
+      "complexity": "low",
+      "ai_factor": "None. Credited to human researchers at Mandiant; no AI tooling is claimed."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Installing Hotfix 10.0.9.6103 (Windows software) or 10.0.9.6105 (hardware and virtual appliance), then 10.0.9.6173 or 10.0.9.6177 to close the exploited chain, and not exposing the Email Security administration interface to the internet.",
+        "was_this_required": true,
+        "framework_requiring_it": "AU-Essential-8-Patch",
+        "adequacy": "Hotfix 10.0.9.6103 or 10.0.9.6105 closes this flaw, but the exploited chain with CVE-2021-20021 and CVE-2021-20023 stays open until 10.0.9.6173 or 10.0.9.6177 is installed. The operator could not add the missing validation to the vendor's branding feature and had to wait for the vendor build, and the end-of-life 7.0.0 through 9.2.2 releases receive no fix."
+      },
+      "detection": {
+        "what_would_have_worked": "Alerting on branding uploads followed by new .jsp files under the web root, and on the Tomcat process spawning cmd.exe.",
+        "was_this_required": false,
+        "framework_requiring_it": "NIST-800-53-SI-10",
+        "adequacy": "The web-shell and process-spawn signals are reliable but fire after a file was already written to an executable web path."
+      },
+      "response": {
+        "what_would_have_worked": "Removing web shells from web-accessible directories, rotating credentials, rebuilding compromised instances, and installing Hotfix 10.0.9.6103 or 10.0.9.6105 and then 10.0.9.6173 or 10.0.9.6177, which closes the chain.",
+        "was_this_required": false,
+        "framework_requiring_it": "NIS2-Art21-network-security",
+        "adequacy": "Patching stops new uploads, but because a web shell may already run with NT AUTHORITY\\SYSTEM rights on a Windows installation, a compromised instance must be rebuilt and its credentials rotated."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-10": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The archive-path check sits in SonicWall's branding code, which the organization cannot change, so SI-10 was met for this input only by installing the hotfix."
+      },
+      "NIS2-Art21-network-security": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Article 21(2)(a) and (e) set no rating method, so a medium-rated post-authentication flaw assessed alone understates a chain that ended in a SYSTEM-level web shell."
+      },
+      "UK-CAF-B4": {
+        "covered": true,
+        "adequate": false,
+        "gap": "'Promptly' is not defined against exploitation that began in March 2021 before the April 9 hotfix, and the unsupported 7.0.0 through 9.2.2 releases have no in-line fix, while the vendor's IPS signature runs only on SonicWall firewalls."
+      },
+      "AU-Essential-8-Patch": {
+        "covered": true,
+        "adequate": false,
+        "gap": "A working exploit exists, so an internet-facing instance had 48 hours from the April 9, 2021 hotfix (ISM-1876 for the Windows software, ISM-1877 for an appliance), but exploitation began in March 2021, before any fix, and no window covers that period."
+      },
+      "ISO-27001-2022-A.8.28": {
+        "covered": true,
+        "adequate": true,
+        "gap": "Secure coding against Zip Slip, applied by the developer to the branding feature, would have prevented the traversal write; the control is adequate."
+      }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-119",
+        "name": "ARCHIVE-CONTENT-TYPE-PROVENANCE",
+        "description": "Upload and archive handlers must dispatch on the content-verified type rather than the supplied name or path, must confine extracted entries to their intended directory, and must never write uploaded content where the web server can execute it.",
+        "evidence": "SonicWall advisory SNWLID-2021-0008 states that CVE-2021-20022 lets a post-authenticated attacker upload an arbitrary file to SonicWall Email Security. Mandiant's report 'Zero-Day Exploits in SonicWall Email Security Lead to Enterprise Compromise' states that an attacker uploaded a ZIP archive from the administrative panel's branding page whose Zip Slip traversal entries exploited CVE-2021-20022 and wrote a BEHINDER JSP web shell into the web-accessible Apache Tomcat directory under webapps. Confining extracted entries to their target directory and refusing to write uploads where the web server executes them removes the file-write primitive the attacker used.",
+        "gap_closes": [
+          "NIST-800-53-SI-10"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "The incident-response default for a network-reachable appliance hit by an actively exploited pre-authentication chain must be to export its configuration, rebuild it and rotate every credential it held, not to patch it in place.",
+        "evidence": "Mandiant documented CVE-2021-20022 used in March 2021 to plant a web shell on an internet-accessible SonicWall Email Security installation on Windows Server 2012, as part of the chain with CVE-2021-20021, so a compromised instance must be rebuilt and its credentials rotated rather than only upgraded to Hotfix 10.0.9.6103 or 10.0.9.6105, or to 10.0.9.6173 or 10.0.9.6177, which closes the chain.",
+        "gap_closes": [
+          "NIS2-Art21-network-security",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
+  },
+  "CVE-2021-1905": {
+    "name": "Qualcomm Multiple Chipsets Use-After-Free Vulnerability (CVE-2021-1905)",
+    "lesson_date": "2026-09-26",
+    "ai_discovered_zeroday": false,
+    "ai_discovery_source": "unknown",
+    "ai_discovery_date": null,
+    "ai_assist_factor": "none",
+    "attack_vector": {
+      "description": "The Qualcomm Adreno GPU kernel driver mishandles GPU memory mappings shared by multiple processes: a shared mapping with several virtual memory areas plus a race between two processes mapping the same GPU memory leaves a freed mapping structure reachable. Project Zero did not have the exploit sample and writes that it is hard to say whether the attack used classical memory corruption through the freed object or a GPU-specific route, such as granting an attacker-controlled GPU context arbitrary physical memory read and write; the CVSS vectors rate the impact as high for confidentiality, integrity and availability.",
+      "privileges_required": "local; the attacker needs code execution in any unprivileged local process on the device, such as a malicious installed app or a process compromised by an earlier exploit in a chain, for example a remote-code-execution and sandbox-escape pair. Google TAG's Buying Spying report describes spyware-vendor exploit chains in which a local privilege escalation is usually the final step, after a remote-code-execution exploit and a sandbox escape.",
+      "complexity": "low per the CVSS vectors from NVD and Qualcomm (AC:L); the trigger is a state error in kgsl_gpumem_vm_close followed by a race between two processes in kgsl_get_unmapped_area",
+      "ai_factor": "None. No AI tooling is claimed and no finder is named."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Applying the Android 2021-05-05 security patch level, or on other platforms the maker's update that integrates the Qualcomm driver fix, on affected devices, which corrects the GPU memory-mapping handling that allows the use-after-free",
+        "was_this_required": true,
+        "framework_requiring_it": "ASD ISM-1878, which applies to operating systems of IT equipment other than workstations, servers and network devices, including handsets: patches are applied within 48 hours of release when the vendor rates the flaw critical or a working exploit exists",
+        "adequacy": "The patch removes the flaw, but it reaches a device only when its maker ships the update, so on a fleet prevention depends on OEM rollout that can lag the platform fix while targeted exploitation is reported."
+      },
+      "detection": {
+        "what_would_have_worked": "Watching for any local process, including an untrusted app or a browser process, making heavy use of the GPU memory-mapping interface and forking to share GPU mappings, and for a local process gaining kernel privilege, using on-device telemetry",
+        "was_this_required": false,
+        "framework_requiring_it": "NIST-800-53-SC-39",
+        "adequacy": "Kernel-escalation signals are hard to observe on mobile endpoints, and the race-based trigger has no network footprint, so detection is weak compared with keeping devices at the fixed patch level."
+      },
+      "response": {
+        "what_would_have_worked": "Bringing affected devices to the 2021-05-05 patch level and rebooting, and quarantining devices that cannot reach it from organizational data until their maker ships the update. For a device of a user who fits a commercial-spyware targeting profile and that ran a security patch level below 2021-05-05, also assessing the device for compromise and capturing evidence before it is reset or reissued.",
+        "was_this_required": false,
+        "framework_requiring_it": "NIS2-Art21-patch-management",
+        "adequacy": "Enforcing the fixed patch level closes the flaw on devices that can install the fix, but installing the update does not show whether a device was compromised before it was updated. Google TAG attributes 0-day use of this flaw against Android to the commercial surveillance vendor Intellexa, so for devices of users who fit a spyware targeting profile, patching without a compromise assessment can leave an earlier compromise undetected."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SC-39": {
+        "covered": true,
+        "adequate": false
+      },
+      "NIS2-Art21-patch-management": {
+        "covered": true,
+        "adequate": false
+      },
+      "UK-CAF-B4": {
+        "covered": true,
+        "adequate": false
+      },
+      "AU-ISM-0298": {
+        "covered": true,
+        "adequate": false
+      },
+      "ISO-27001-2022-A.8.8": {
+        "covered": true,
+        "adequate": false
+      }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-126",
+        "name": "MOBILE-OS-MINIMUM-PATCH-LEVEL-ENFORCEMENT",
+        "description": "Access to organizational data from a managed mobile device depends on the device meeting a minimum operating-system security-patch level that carries the fix, and devices below it are blocked or quarantined rather than accepted on a compliance dashboard.",
+        "evidence": "The Android Security Bulletin for May 2021 lists CVE-2021-1905 under the 2021-05-05 security patch level, not the 2021-05-01 level, and Qualcomm's May 2021 bulletin says OEMs were notified and strongly recommended to release patches on end devices. Gating organizational-data access on a device reporting 2021-05-05 or later, and quarantining devices that report an earlier level, including 2021-05-01, closes the fleet exposure until each device's maker ships that level.",
+        "gap_closes": [
+          "UK-CAF-B4",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "AU-ISM-0298"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-003",
+        "name": "KERNEL-EXPLOITATION-DETECTION",
+        "description": "Host-level detection rules for privilege-escalation indicators are deployed and alert within seconds, so exploitation of a local escalation flaw is observed even before the fix is installed.",
+        "evidence": "The Android Security Bulletin for May 2021 reports indications that CVE-2021-1905, a use-after-free in the Qualcomm Adreno GPU kernel driver reached by a local process, may be under limited, targeted exploitation. Google Project Zero's root-cause analysis says runtime anomaly detection might be one way to detect similar 0-days but would require specialist tooling, so on-device detection is a compensating signal only where that tooling is deployed on devices that do not yet carry the 2021-05-05 security patch level.",
+        "gap_closes": [
+          "NIST-800-53-SC-39",
+          "ISO-27001-2022-A.8.8"
+        ]
+      }
+    ]
   }
 }