Re:Cross-platform Rust rewrite of the GNU coreutils
by jstimpfle on Tuesday March 22, 2016 @06:47PM
(#11340553)
I don't think you can count use-after-free as exploitable. Sure, if you have them (and I think those cases can largely be ruled out by good design), it leads to crashes. But for memory type exploits you need control over the value in it. Not a security specialist but I'm not aware of common attacks besides overflowing buffers.
In hot paths (like codecs, compression algorithms...) I'm sure you never want bounds checking. It can be optimized away for sequential loops of course, but not so easily in the case of data lookups.
Re:Cross-platform Rust rewrite of the GNU coreutils
by pcwalton on Tuesday March 22, 2016 @07:04PM
(#11340653)
Use after free is a really common form of RCE. Have you heard the term "heap spray"? That's an exploitation technique for use after free.
Re:Cross-platform Rust rewrite of the GNU coreutils
by steveklabnik on Tuesday March 22, 2016 @06:48PM
(#11340557)
Re:Cross-platform Rust rewrite of the GNU coreutils
by jstimpfle on Tuesday March 22, 2016 @06:52PM
(#11340585)
"While it is technically feasible for the freed memory to be re-allocated and for an attacker to use this reallocation to launch a buffer overflow attack, we are unaware of any exploits based on this type of attack."
Re:Cross-platform Rust rewrite of the GNU coreutils
by pcwalton on Tuesday March 22, 2016 @07:08PM
(#11340680)
It's so common there's a tutorial on it: http://www.fuzzysecurity.com/tutorials/expDev/11.html
Re:Cross-platform Rust rewrite of the GNU coreutils
by jstimpfle on Tuesday March 22, 2016 @07:10PM
(#11340686)
Thanks!
Re:Cross-platform Rust rewrite of the GNU coreutils
by comex on Tuesday March 22, 2016 @06:59PM
(#11340626)
I have no idea what that article is talking about. Use-after-free exploits have been extremely common for years. Like I said, look at Pwn2Own (which requires submitting an actual working exploit): https://www.google.com/search?q=pwn2own+use-after-free
Re:Cross-platform Rust rewrite of the GNU coreutils
by steveklabnik on Tuesday March 22, 2016 @07:23PM
(#11340770)
Gah, it seems this one isn't good. I trust OWASP and skimmed, it seems that I agree with sibling commentors that this is more dangerous than is presented here.
The borrow checker eliminates use-after-free. And use-after-free is one of the most common types of vulnerability exploited in practice today, if not the single most common. (For evidence, look at reports about Pwn2Own.)
Index checking is quite cheap for most programs, and LLVM is good at eliminating redundant checks. As a useful comparison in another languages, Chromium compiles with bounds checks on std::vector by default (the [] operator, not the at() method which is required to be checked.) Actually, there are a lot of issues with Rust's current machine code output that I think slow it down, but index checking isn't one of them.