News for hackers. Stuff that matters.

A comment on OpenSSH Pre-Auth Double Free – CVE-2023-25136 – Writeup and Proof-of-Concept. Parent comment

Re:OpenSSH Pre-Auth Double Free – CVE-2023-25136 – Writeup a... by HideousKojima on Wednesday February 08, 2023 @06:02PM (#34716875)
"A car with seatbelts can still crash, so why bother driving a car that has seatbelts?"

The class of error in the article is impossible in Rust unless you explicitly choose to use unsafe.

[ Parent | on HN ]
Re:OpenSSH Pre-Auth Double Free – CVE-2023-25136 – Writeup a... by snvzz on Wednesday February 08, 2023 @06:48PM (#34717486)
>why bother driving a car that has seatbelts

The implication openssh has no seatbelts is very wrong.

OpenSSH's internal architecture was engineered for robustness, and has privilege separation and sandboxing.

[ Parent | on HN ]
Re:OpenSSH Pre-Auth Double Free – CVE-2023-25136 – Writeup a... by HideousKojima on Wednesday February 08, 2023 @08:30PM (#34718508)
And yet TFA is about yet another vulnerability caused by something that Rust is immune to.
[ Parent | on HN ]
Re:OpenSSH Pre-Auth Double Free – CVE-2023-25136 – Writeup a... by 0xbadcafebee on Thursday February 09, 2023 @09:41AM (#34724590)
* * *
[ Parent | on HN ]