Attackers are exploiting a NetScaler DTLS memory overflow before authentication

The exposed surface is DTLS reassembly. DTLS is TLS carried over UDP, and one UDP packet can hold several DTLS records, each opening with a 13-byte header ^[10]. A record carrying handshake data adds a 12-byte fragment header ^[11]. Four of its fields matter: length, message_seq, fragment_offset and fragment_length ^[12]. length is the full message size, fragment_offset says where a fragment belongs, and fragment_length how many bytes it carries ^[12]. A message can arrive split across many fragments, and the server rebuilds it by placing each fragment at the offset it claims ^[12]. NetScaler holds the received bytes in linked buffers it calls NSBs, and once reassembly finishes an NSPPE function stitches that chain together ^[13].

NetScaler is Citrix's application delivery controller, now under Cloud Software Group, and it sits in front of an organization's applications to balance load and terminate SSL/TLS ^[1]. NetScaler Gateway adds the VPN and remote access that make it internet-facing ^[2]. A security appliance concentrates a defensive function at a single chokepoint every connection has to pass through ^[15]. Citrix calls such a box hardened, meaning minimal services, a restricted shell, a controlled update path and security-tuned defaults, and pitches it as tougher to break into than a general-purpose server ^[14]. That reassembly runs before the sender authenticates ^[3], so anyone who can reach the box with UDP packets reaches the flaw ^[10].

watchTowr Labs, not Citrix, wrote the technical walk-through and titled it "Here We Go Again," its second analysis of this one advisory in two days ^[16].