RegreSSHion: RCE in OpenSSH's server, on glibc-based Linux systems

Re:RegreSSHion: RCE in OpenSSH's server, on glibc-based Linu... by michaelt on Monday July 01, 2024 @06:56PM (#40851732)

> "only intended for processing data from trusted sources" is a frankly ridiculous policy for a serialization/deserialization library.

Truly, it's a design decision so ridiculous nobody else has made it. Except Python's pickle, Java's serialization, Ruby's Marshal and PHP's unserialize of course. But other than that, nobody!

[ Parent | on HN ]

Re:RegreSSHion: RCE in OpenSSH's server, on glibc-based Linu... by YoumuChan on Tuesday July 02, 2024 @12:13AM (#40853503)

And Lua's bytecode loader, recently discussed here: https://news.ycombinator.com/item?id=40830005

[ Parent | on HN ]

Re:RegreSSHion: RCE in OpenSSH's server, on glibc-based Linu... by Dylan16807 on Tuesday July 02, 2024 @02:06AM (#40853942)

I know "code is data", but it's a couple orders of magnitude more reasonable to have unsafe bytecode than to have unsafe data deserialization.

If something is supposed to load arbitrary code, not just data, that needs to be super clear at a glance. If it comes across as a data library, but allows takeover, you have a problem. Especially if there isn't a similar data-only function/library.

[ Parent | on HN ]

Re:RegreSSHion: RCE in OpenSSH's server, on glibc-based Linu... by brazzy on Tuesday July 02, 2024 @02:57AM (#40854188)

Yes, all of those languages made that bad decision back in the 90s and came to regret it. What's ridiculous is refusing to learn from that.

[ Parent | on HN ]