News for hackers. Stuff that matters.

A comment on Glibc Dynamic Loader Hit by a Nasty Local Privilege Escalation Vulnerability. Parent comment

Re:Glibc Dynamic Loader Hit by a Nasty Local Privilege Escal... by blueflow on Tuesday October 03, 2023 @07:16PM (#37758863)
musl has a better track record of standards compliance than glibc. Common method for porting to musl is putting non-standard compliant code into an ifdef glibc.
[ Parent | on HN ]
Re:Glibc Dynamic Loader Hit by a Nasty Local Privilege Escal... by kazinator on Tuesday October 03, 2023 @07:31PM (#37758978)
Counterexample: musl's crypt() does silly things, like treat all unrecognized inputs as DES, even if the salt characters are invalid.
[ Parent | on HN ]
Re:Glibc Dynamic Loader Hit by a Nasty Local Privilege Escal... by q66 on Wednesday October 04, 2023 @09:49AM (#37765148)
at least it actually supports blowfish
[ Parent | on HN ]
Re:Glibc Dynamic Loader Hit by a Nasty Local Privilege Escal... by kelnos on Tuesday October 03, 2023 @09:16PM (#37759745)
This is, of course, the same musl that refused to implement TCP DNS requests until very recently. And they only did so because the DNS standards people got fed up with people not implementing it, and made it a requirement.
[ Parent | on HN ]
Re:Glibc Dynamic Loader Hit by a Nasty Local Privilege Escal... by blueflow on Wednesday October 04, 2023 @04:26AM (#37762396)
And glibc is the one not implementing strlcpy and strlcat until June 2023.
[ Parent | on HN ]
Re:Glibc Dynamic Loader Hit by a Nasty Local Privilege Escal... by pantalaimon on Wednesday October 04, 2023 @05:46PM (#37772262)
strscpy is the better API anyway
[ Parent | on HN ]
Re:Glibc Dynamic Loader Hit by a Nasty Local Privilege Escal... by fanf2 on Wednesday October 04, 2023 @10:45AM (#37765937)
It was made a requirement by RFC 7766 in 2016 https://www.rfc-editor.org/rfc/rfc7766#page-6
[ Parent | on HN ]
Re:Glibc Dynamic Loader Hit by a Nasty Local Privilege Escal... by dralley on Wednesday October 04, 2023 @03:01PM (#37769978)
That doesn't necessarily contradict "the DNS standards people got fed up with people not implementing it, and made it a requirement."?
[ Parent | on HN ]
Re:Glibc Dynamic Loader Hit by a Nasty Local Privilege Escal... by fanf2 on Thursday October 05, 2023 @09:26AM (#37778319)
It took musl about 6 years to implement the requirement.
[ Parent | on HN ]
Re:Glibc Dynamic Loader Hit by a Nasty Local Privilege Escal... by smsm42 on Wednesday October 04, 2023 @12:40AM (#37760927)
[delayed]
[ Parent | on HN ]