News for hackers. Stuff that matters.

A comment on Cross-platform Rust rewrite of the GNU coreutils. Parent comment

Re:Cross-platform Rust rewrite of the GNU coreutils by jstimpfle on Tuesday March 22, 2016 @06:47PM (#11340553)
I don't think you can count use-after-free as exploitable. Sure, if you have them (and I think those cases can largely be ruled out by good design), it leads to crashes. But for memory type exploits you need control over the value in it. Not a security specialist but I'm not aware of common attacks besides overflowing buffers.

In hot paths (like codecs, compression algorithms...) I'm sure you never want bounds checking. It can be optimized away for sequential loops of course, but not so easily in the case of data lookups.

[ Parent | on HN ]
Re:Cross-platform Rust rewrite of the GNU coreutils by pcwalton on Tuesday March 22, 2016 @07:04PM (#11340653)
Use after free is a really common form of RCE. Have you heard the term "heap spray"? That's an exploitation technique for use after free.
[ Parent | on HN ]
Re:Cross-platform Rust rewrite of the GNU coreutils by steveklabnik on Tuesday March 22, 2016 @06:48PM (#11340557)
https://www.owasp.org/index.php/Using_freed_memory
[ Parent | on HN ]
Re:Cross-platform Rust rewrite of the GNU coreutils by jstimpfle on Tuesday March 22, 2016 @06:52PM (#11340585)
"While it is technically feasible for the freed memory to be re-allocated and for an attacker to use this reallocation to launch a buffer overflow attack, we are unaware of any exploits based on this type of attack."
[ Parent | on HN ]
Re:Cross-platform Rust rewrite of the GNU coreutils by pcwalton on Tuesday March 22, 2016 @07:08PM (#11340680)
It's so common there's a tutorial on it: http://www.fuzzysecurity.com/tutorials/expDev/11.html
[ Parent | on HN ]
Re:Cross-platform Rust rewrite of the GNU coreutils by jstimpfle on Tuesday March 22, 2016 @07:10PM (#11340686)
Thanks!
[ Parent | on HN ]
Re:Cross-platform Rust rewrite of the GNU coreutils by comex on Tuesday March 22, 2016 @06:59PM (#11340626)
I have no idea what that article is talking about. Use-after-free exploits have been extremely common for years. Like I said, look at Pwn2Own (which requires submitting an actual working exploit): https://www.google.com/search?q=pwn2own+use-after-free
[ Parent | on HN ]
Re:Cross-platform Rust rewrite of the GNU coreutils by steveklabnik on Tuesday March 22, 2016 @07:23PM (#11340770)
Gah, it seems this one isn't good. I trust OWASP and skimmed, it seems that I agree with sibling commentors that this is more dangerous than is presented here.
[ Parent | on HN ]