News for hackers. Stuff that matters.
Re:This shouldn't have happened: A vulnerability postmortem by cjbprime on Wednesday December 01, 2021 @04:42PM (#29409499)
Go is sometimes considered memory unsafe because of the presence of data races. (This is a controversial semantics.)
Re:This shouldn't have happened: A vulnerability postmortem by asdfasgasdgasdg on Wednesday December 01, 2021 @08:16PM (#29411368)
Even in the case of data races, you could not develop an exploit like the one discussed in this blog post, right? It's kinda a non-sequitur in this context?
Re:This shouldn't have happened: A vulnerability postmortem by saagarjha on Thursday December 02, 2021 @01:08AM (#29413050)
Go allows data races to arbitrarily corrupt metadata, which is the precursor to an exploit like this. A brief rule-of-thumb is if the race allows you to directly touch data that isn't available via APIs, such as the count on a vector–once you do that, you can "resize" it to be larger than its actual size, and run off the end to do whatever you want. (There are many other ways to achieve something similar: type confusion, etc.)
Re:This shouldn't have happened: A vulnerability postmortem by senderista on Wednesday December 01, 2021 @05:20PM (#29409901)
Then Java is also unsafe by the same standard.
Re:This shouldn't have happened: A vulnerability postmortem by cjbprime on Wednesday December 01, 2021 @05:48PM (#29410171)
Why do you say that? Go's data races can produce memory corruption through bounds checking failures. I'm not aware of Java having that kind of memory corruption.
Re:This shouldn't have happened: A vulnerability postmortem by josephg on Wednesday December 01, 2021 @07:03PM (#29410804)
Yes. Java and C# are unsafe by the same standard. Last I checked, they both allow multiple threads to nonatomically modify a raw variable - which can lead to data races and data corruption.

I haven't heard of anyone getting RCE out of this class of bug in C# or java though.

Re:This shouldn't have happened: A vulnerability postmortem by fulafel on Thursday December 02, 2021 @01:12AM (#29413074)
JVM semantics[1] don't allow this to corrupt program state arbitrarily, just the data variables in question, right? Whereas in Go.. Search for "corruption" in https://research.swtch.com/gomm

[1] Not just Java, meaning all the many nice JVM languages enjoy this is as well, eg Clojure, Scala etc

Re:This shouldn't have happened: A vulnerability postmortem by astrange on Thursday December 02, 2021 @12:37AM (#29412903)
It's common to exploit JavaScript engines with this kind of bug, and JS engines probably have better security teams at this point, so I expect you could get an RCE if you really tried.
Re:This shouldn't have happened: A vulnerability postmortem by saagarjha on Thursday December 02, 2021 @01:09AM (#29413059)
Yes, but those would be bugs in the runtime itself, rather than in the programming language. Java and JavaScript both define behavior of racy code; Go does not.