News for hackers. Stuff that matters.

A comment on “Most serious” Linux privilege-escalation bug ever is under active exploit. Parent comment

Re:“Most serious” Linux privilege-escalation bug ever is und... by snvzz on Friday October 21, 2016 @09:00AM (#12760010)
> C, due to arrays, strings, arithmetic operations and memory allocations requiring unsafe code leads to 100% unsafe code across the existing code.

Imply is just slightly too harsh. Writing safe C code is very possible, as proven by projects such as seL4 or engineers such as djb.

[ Parent | on HN ]
Re:“Most serious” Linux privilege-escalation bug ever is und... by pjmlp on Friday October 21, 2016 @10:04AM (#12760487)
Those projects had to constrained themselves to having 100% of the code available, no binary libraries and lock the compiler versions being used.

Since the early 90's I keep hearing that it is possible to write safe C code, yet outside in the real world, unless constrained by processes like MISRA-C and Frama-C, which isn't really C anymore, it never works.

The proof is the amount of CVE exploits, that get reported almost daily!

Just yesterday while reading some papers on Cyclone, I discovered this jewel:

"X El Capitan v10.11.6 and Security Update 2016-004" release notes

https://support.apple.com/en-us/HT206903

From 36 bug fixes, 31 are related C memory corruption issues!

[ Parent | on HN ]
Re:“Most serious” Linux privilege-escalation bug ever is und... by snvzz on Friday October 21, 2016 @12:02PM (#12761525)
OSX is pretty bad as they go.

MACH based hybrid kernel garbage.

A shame, considering Apple actually has the resources for doing a proper rebase of XNU on L4 and with actual pure microkernel multiserver architecture.

[ Parent | on HN ]