summary 2 Project Summary 3 Audit Scope 4 Threat model 5 Fuzzing 15 Issues found 17 SLSA 43 Supply-chain mitigations 45 1 Dapr security audit 2023 Executive summary In May and June 2023, Ada Logics the conclusion of the audit. An area for future work on Daprs security posture is its so�ware supply-chain. The SLSA review showed that Dapr is lacking a compliant provenance attestation alongside release We also included recommendations on how Dapr can ensure the quality and integrity of its own supply-chain via its dependency tree. 1 CVE-2023-37475 2 Dapr security audit 2023 Results summarised 7

glossary. • italic: Italic type indicates book titles, emphasis, or placeholder variables for which you supply particular values. • monospace: Monospace type indicates commands within a paragraph, URLs, code machine, and for read operations, Oracle VM VirtualBox may need to look up all the parents in the chain until the sector in question is found. You can view such a tree in the Virtual Media Manager. 96 snapshot, for each hard disk attachment, another differencing image is created and attached, forming a chain or tree. In the above screenshot, you see that the original disk image is now attached to a snapshot

glossary. • italic: Italic type indicates book titles, emphasis, or placeholder variables for which you supply particular values. • monospace: Monospace type indicates commands within a paragraph, URLs, code machine, and for read operations, Oracle VM VirtualBox may need to look up all the parents in the chain until the sector in question is found. You can view such a tree in the Virtual Media Manager. 100 snapshot, for each hard disk attachment, another differencing image is created and attached, forming a chain or tree. In the above screenshot, you see that the original disk image is now attached to a snapshot

glossary. • italic: Italic type indicates book titles, emphasis, or placeholder variables for which you supply particular values. • monospace: Monospace type indicates commands within a paragraph, URLs, code machine, and for read operations, Oracle VM VirtualBox may need to look up all the parents in the chain until the sector in question is found. You can view such a tree in the Virtual Media Manager. 96 snapshot, for each hard disk attachment, another differencing image is created and attached, forming a chain or tree. In the above screenshot, you see that the original disk image is now attached to a snapshot

glossary. • italic: Italic type indicates book titles, emphasis, or placeholder variables for which you supply particular values. • monospace: Monospace type indicates commands within a paragraph, URLs, code machine, and for read operations, Oracle VM VirtualBox may need to look up all the parents in the chain until the sector in question is found. You can view such a tree in the Virtual Media Manager. 100 snapshot, for each hard disk attachment, another differencing image is created and attached, forming a chain or tree. In the above screenshot, you see that the original disk image is now attached to a snapshot

glossary. • italic: Italic type indicates book titles, emphasis, or placeholder variables for which you supply particular values. • monospace: Monospace type indicates commands within a paragraph, URLs, code machine, and for read operations, Oracle VM VirtualBox may need to look up all the parents in the chain until the sector in question is found. You can view such a tree in the Virtual Media Manager. 100 snapshot, for each hard disk attachment, another differencing image is created and attached, forming a chain or tree. In the above screenshot, you see that the original disk image is now attached to a snapshot

glossary. • italic: Italic type indicates book titles, emphasis, or placeholder variables for which you supply particular values. • monospace: Monospace type indicates commands within a paragraph, URLs, code machine, and for read operations, Oracle VM VirtualBox may need to look up all the parents in the chain until the sector in question is found. You can view such a tree in the Virtual Media Manager. 96 snapshot, for each hard disk attachment, another differencing image is created and attached, forming a chain or tree. In the above screenshot, you see that the original disk image is now attached to a snapshot

glossary. • italic: Italic type indicates book titles, emphasis, or placeholder variables for which you supply particular values. • monospace: Monospace type indicates commands within a paragraph, URLs, code machine, and for read operations, Oracle VM VirtualBox may need to look up all the parents in the chain until the sector in question is found. You can view such a tree in the Virtual Media Manager. 100 snapshot, for each hard disk attachment, another differencing image is created and attached, forming a chain or tree. In the above screenshot, you see that the original disk image is now attached to a snapshot

glossary. • italic: Italic type indicates book titles, emphasis, or placeholder variables for which you supply particular values. • monospace: Monospace type indicates commands within a paragraph, URLs, code machine, and for read operations, Oracle VM VirtualBox may need to look up all the parents in the chain until the sector in question is found. You can view such a tree in the Virtual Media Manager. 100 snapshot, for each hard disk attachment, another differencing image is created and attached, forming a chain or tree. In the above screenshot, you see that the original disk image is now attached to a snapshot

glossary. • italic: Italic type indicates book titles, emphasis, or placeholder variables for which you supply particular values. • monospace: Monospace type indicates commands within a paragraph, URLs, code machine, and for read operations, Oracle VM VirtualBox may need to look up all the parents in the chain until the sector in question is found. You can view such a tree in the Virtual Media Manager. 100 snapshot, for each hard disk attachment, another differencing image is created and attached, forming a chain or tree. In the above screenshot, you see that the original disk image is now attached to a snapshot