News for hackers. Stuff that matters.

A comment on This shouldn't have happened: A vulnerability postmortem. Parent comment

Re:This shouldn't have happened: A vulnerability postmortem by josephg on Wednesday December 01, 2021 @07:03PM (#29410804)
Yes. Java and C# are unsafe by the same standard. Last I checked, they both allow multiple threads to nonatomically modify a raw variable - which can lead to data races and data corruption.

I haven't heard of anyone getting RCE out of this class of bug in C# or java though.

[ Parent | on HN ]
Re:This shouldn't have happened: A vulnerability postmortem by fulafel on Thursday December 02, 2021 @01:12AM (#29413074)
JVM semantics[1] don't allow this to corrupt program state arbitrarily, just the data variables in question, right? Whereas in Go.. Search for "corruption" in https://research.swtch.com/gomm

[1] Not just Java, meaning all the many nice JVM languages enjoy this is as well, eg Clojure, Scala etc

[ Parent | on HN ]
Re:This shouldn't have happened: A vulnerability postmortem by astrange on Thursday December 02, 2021 @12:37AM (#29412903)
It's common to exploit JavaScript engines with this kind of bug, and JS engines probably have better security teams at this point, so I expect you could get an RCE if you really tried.
[ Parent | on HN ]
Re:This shouldn't have happened: A vulnerability postmortem by saagarjha on Thursday December 02, 2021 @01:09AM (#29413059)
Yes, but those would be bugs in the runtime itself, rather than in the programming language. Java and JavaScript both define behavior of racy code; Go does not.
[ Parent | on HN ]