So could have Java, Go, C# or any language with GC. With garbage collection, the options object stays alive as long as any CPU holds a pointer to it, so use-after-free can’t happen.
Besides, this exploit is so hard to pull off the only realistic outcome is a kernel panic, and that hasn’t even been publicly demoed.
I don’t think a rewrite in Rust is necessary for everything that has a bug. Instead fixing the bug is probably more secure, before such alternative Rust code is mature enough to replace it.
It doesn’t. It’s just a separate fact that Rust allows LLM generated code in. The common argument is that Rust doesn’t make everything it touches secure.
The common argument is that Rust doesn’t make everything it touches secure.
No one said Rust makes everything it touches secure. You should stop thinking in black and white. I said this specific issue would not have happened with Rust, because Rust catches this type of issue at compilation time.
I sent a link to a use-after-free bug in RedoxOS, the OS advertised as being written in Rust for security. The issue is tracked as CVE with severity 7.8.
This specific issue would have been prevented with with Rust.
Rust haters in shambles
So could have Java, Go, C# or any language with GC. With garbage collection, the options object stays alive as long as any CPU holds a pointer to it, so use-after-free can’t happen.
Besides, this exploit is so hard to pull off the only realistic outcome is a kernel panic, and that hasn’t even been publicly demoed.
No. Those aren’t allowed in Linux Kernel.
Garbage Collection is not usable in an operating system Kernel.
Clearly, but it’s worth pointing out that this kind of problem isn’t uniquely fixed by “just use Rust”.
I never said that only Rust prevents this. I just said using Rust in the Kernel would have prevented this issue.
Fair enough. Don’t you think it simplifies the issue a little bit? How long would it take to rewrite the entire TCP stack in rust?
I don’t think a rewrite in Rust is necessary for everything that has a bug. Instead fixing the bug is probably more secure, before such alternative Rust code is mature enough to replace it.
lol no, Rust itself is AI now btw
This is an issue from 2019?
Still open? Only tagged in 2024?
How makes this rust ai?
It doesn’t. It’s just a separate fact that Rust allows LLM generated code in. The common argument is that Rust doesn’t make everything it touches secure.
No one said Rust makes everything it touches secure. You should stop thinking in black and white. I said this specific issue would not have happened with Rust, because Rust catches this type of issue at compilation time.
This type of issue is called use-after-free.
I sent a link to a use-after-free bug in RedoxOS, the OS advertised as being written in Rust for security. The issue is tracked as CVE with severity 7.8.
That’s a bug.
Unsafe allows that, yes.