74
Several Linux Kernel Vulnerabilities Accidentally Posted To Public Kernel Mailing List (www.phoronix.com)
submitted 11 hours ago by to c/linux@programming.dev
16 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 6 points 10 hours ago (7 children)

SMB Direct remote code execution vulnerability due to integer underflow.

It's a day ending in 'y' and we've found another RCE that wouldn't exist in a modern language designed to catch things like integer under/overflow.

  • permalink
  • fedilink
  • source
  • hideshow 7 child comments
    •
  • [–] 9 points 9 hours ago (4 children)

    Yes, we get it, you like rust.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 8 points 8 hours ago* (3 children)

    I mean yes, I do, given safe Rust inherently fixes seemingly every exploit listed in this article:

    • RCE from integer overflow (not possible by default in Rust, CVSS 9.0)
    • RCE from a race condition (not possible in safe Rust, CVSS 9.0)
    • An exploit of a buffer copy
    • An out-of-bounds write leading to local privilege escalation
    • Using an uninitialized resource
    • TCP query stack buffer overflow leading to local privilege escalation

    I feel like it's the 1960s and I'm being told "we get it, you like seatbelts".

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [+] -10 points 8 hours ago (2 children)

    Yeah because the way you said it is extremely dick-ish and sounds like someone trying to push their preferred language onto others.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 14 points 8 hours ago* (1 child)

    > "sounds like someone trying to push their preferred language onto others."

    > didn't even name Rust in the first comment

    I literally only talked about Rust when someone else mentioned it, because I'm not specifically talking about Rust.

    Whereas yes, Rust is relevant to the Linux kernel for obvious reasons (matching C's speed and being easily interoperable with it), I said "a modern language" because I'm talking generally about the use of old, unsafe languages and major exploits surrounding problems that modern languages fix cropping up every 5 seconds.

    I'm not going to police my own tone about what are clearly negligent engineering practices. SWE should be treated with the same level of scrutiny as other engineering fields when its poor, outdated practices are constantly causing accelerating worldwide damage.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] -1 points 9 hours ago (1 child)

    Start stroking your keys on your keyboard in said language and fix the RCE yourself instead of typing stuff here that contributes to nothing.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •