Comment by cowlevel
7 hours ago
The bug is integer overflow in a random C data-processing library (specifically regexes) leading to RCE.
Who else is tired of C libraries since this week?
7 hours ago
The bug is integer overflow in a random C data-processing library (specifically regexes) leading to RCE.
Who else is tired of C libraries since this week?
I've been calling this out for forever now and have been repeatedly told that actually, competent devs with C are fine and the C software we use has been battle tested so it's largely secure.
And now we are seeing that was all untrue.
now it's even more battle tested!
Let's rewrite everything - said every 15 minutes by every new developer with a new toy.
How about being constructive instead - old bug in old code is no surprise, no matter the language/technology.
This was hardly a convincing argument before the current CVE explosion. By now C needs to be dead and buried for network accessible code.
Someone needs to tell DARPA:
https://www.darpa.mil/research/programs/translating-all-c-to...
How is this constructive when you're offering nothing to construct? Just saying not to be surprised.
1 reply →
And how does Rust help? As far as I know, an integer overflow in Rust panics in debug but just wraps in release (a bad choice in my opinion). Would it help specifically in the code execution part of the exploit?
The key difference is even If an Integer overflows in Rust It still doesn't violate memory safety in safe Rust and therefore doesn't lead to exploitation.
[profile.release] overflow-checks = true
I've heard the joke many times, but I didn't expect that even programming would ever end up wanting to evolve to crabs.