51–60 of 68 posts
Is there a fix for older OSX or should I just install Linux on my 2011 iMac? Yosemite is already quite slow. OpenSuSE 13.2 was really fast on a same generation Mac Mini.
Your 2011 iMac can be update to 10.13, so I would update, a iMac 2011 with enough ram and a ssd works very well even on 10.13.
Another day, another buffer overflow caused by C's memory model. At least ARM is getting pointer tagging.
TL;DR: Heap buffer overflow in the network stack allowed for sending ICMP packets that would crash devices. Bug was marked as "RCE" because it's possible that it could be used for code execution, though the current PoC only causes a crash. Bug has been reported to Apple and fixed in iOS 12 and macOS Mojave 10.14. There's an excellent drawing by the author at the end of the author summarizing the exploit ;) As an asid…
It's not receiving an ICMP packet that causes the crash, it's when sending an ICMP error response packet. ICMP error packets can be generated in response to any type of IP packet, for example "host unreachable" when using UDP. These packets copy the original header of the packet which generated the error, which is where the out-of-bounds copy is.
I understand why the author doesn't want to give full details, but in this case it leads to a lot of misunderstandings on how it works.
How long until somebody builds a device that is basically a pwnplug, which joins wifi networks at major tech conferences, does an nmap for live IPs, and sends this to every device?
These things happen.
Another day, another buffer overflow caused by C's memory model. At least ARM is getting pointer tagging.
Caused by Apple copy pasting networking BSD code, missing a crucial bounds check in the process (as noted by another reply ITT). Here: https://news.ycombinator.com/item?id=18351533
Unless the same mistake would have been done inside an unsafe code block/module.
If anything, C's history of memory corruption errors and how they come to be, proves that even the best aren't able to follow best practices that apparently all good C coders do.
Linux kernel is full of such CVEs in spite of the approval processes in place to accept new code into the kernel, and I assume Apple does have similar practices in place.
Earlier quoted context omitted.
Caused by Apple copy pasting networking BSD code, missing a crucial bounds check in the process (as noted by another reply ITT). Here: https://news.ycombinator.com/item?id=18351533
Which in a language with bounds checking would usually mean a panic instead of a memory corruption leading to possible exploit. Unless the same mistake would have been done inside an unsafe code block/module. If anything, C's history of memory corruption errors and how they come to be, proves that even the best aren't able to follow best practices that apparently all good C coders do. Linux kernel is full of such CVE…
I see your point, and I agree partly, some languages can avoid the particular secuence of events in this bug or make it more difficult.
In this case, imagine:
- Sloppiness getting code into the icmp module (this is speculation, to be fair).
- Buffer overrun leading to RCE.
- Solution:
1 You rewrite in rust because you think the root cause is that C is unsafe.
2 You don't write sloppy code, higher your standars, more audit/testing/verification.
Earlier quoted context omitted.
Which in a language with bounds checking would usually mean a panic instead of a memory corruption leading to possible exploit. Unless the same mistake would have been done inside an unsafe code block/module. If anything, C's history of memory corruption errors and how they come to be, proves that even the best aren't able to follow best practices that apparently all good C coders do. Linux kernel is full of such CVE…
Yeah. C gives you little safety nets. But the problem here is a missing check. Do the same (logic mistakes) in Rust, Java, C#, JavaScript etc and you will, sooner or later, give access to your admin account, to your DB, to a command shell or to memory, writting not permitted values by omiting a validation check etc. I see your point, and I agree partly, some languages can avoid the particular secuence of events in th…
The thing is,
Σ logic errors So while errors don't go away, the exploit area is considerably dimished.
Naturally it gets hand waved as errors are errors.
Which is why I really do look forward for harder lawsuits when security exploits happen.
When money starts speaking, more companies will take security more seriously.
Earlier quoted context omitted.
Yeah. C gives you little safety nets. But the problem here is a missing check. Do the same (logic mistakes) in Rust, Java, C#, JavaScript etc and you will, sooner or later, give access to your admin account, to your DB, to a command shell or to memory, writting not permitted values by omiting a validation check etc. I see your point, and I agree partly, some languages can avoid the particular secuence of events in th…
That is the typical defense argument I keep getting from C crowd since the mid-90's. The thing is, Σ logic errors So while errors don't go away, the exploit area is considerably dimished. Naturally it gets hand waved as errors are errors. Which is why I really do look forward for harder lawsuits when security exploits happen. When money starts speaking, more companies will take security more seriously.
But, all I was saying in the beginning (and I later digressed) is that just blaming 'C memory model' is not fair.
(Dramatization) "Hey, boss, yes... an RCE, what a pitty. Yeah, missing check. But don't blame me. Is C it is at fault". That is just not realistic/ridiculous. Is like saying is the parents of Denis Ritchie that are at fault here.
Earlier quoted context omitted.
Really? I found Skia easier to compile than actually use.
One needs to duplicate Google's build infrastructure, which is quite a pain versus other open source projects that rely on more mainstream tooling.