Live data from Hacker News

Rust’s standard library was vulnerable for years and nobody noticed

medium.com

11–20 of 58 posts

Re: Rust’s standard library was vulnerable for years and nobody noticed

#11
post #5

I don't really like the message. For me, it's not "boo, a bug was found after years", it's "yay, they managed to find it!". Bugs are inevitable, security bugs as well. What I don't understand though is how they ended up with that bug in deque implementation anyway. Does Rust use "unsafe" keyword for its major data structures? If so, why? I would assume that having Box would let you implement most of the ideas without…

I didn't feel this way about the post, but I understand your pov.

To me it was important to know that rust doesn't create perfect code out of the box even with all the beautiful theory and design.

It's good to stay alert in a way

Re: Rust’s standard library was vulnerable for years and nobody noticed

#12
Some readers seem to be getting thrown by the casual tone of this article. For those struggling to not rage my two takeaways were:

* Automated checking of rusts std lib could improve rusts security

* Don't use unsafe if you don't need it

* Releasing a fix for a security vulnerability should be complemented with a cve if you want people (such as anyone using Debian) to not still be vulnerable two years later

Note: despite the initial slant, the author is very pro rust.

Re: Rust’s standard library was vulnerable for years and nobody noticed

#13
post #5

I don't really like the message. For me, it's not "boo, a bug was found after years", it's "yay, they managed to find it!". Bugs are inevitable, security bugs as well. What I don't understand though is how they ended up with that bug in deque implementation anyway. Does Rust use "unsafe" keyword for its major data structures? If so, why? I would assume that having Box would let you implement most of the ideas without…

I didn't feel this way about the post, but I understand your pov. To me it was important to know that rust doesn't create perfect code out of the box even with all the beautiful theory and design. It's good to stay alert in a way

in the same way, farbage collectora can have bugs that make memory mistakes. has happened to me.

Re: Rust’s standard library was vulnerable for years and nobody noticed

#14
> For example, Erlang — that funky language that people use to program systems with 99,9999999% uptime (no, that’s not an exaggeration) — has repeatedly shipped with a broken implementation of Map data structure in its standard library.

…during the period ‘maps’ was a experimental/beta-feature.

Re: Rust’s standard library was vulnerable for years and nobody noticed

#15
The comments in this entry are harsher than I expected after having completed the article. I agree that the headline was a little misleading (maybe that's harsh, but perhaps a little click-baitey). He had one, sort-of peripheral story that was really important to me -- paraphrased:

> Your bug tracker probably has some security vulnerabilities that were misidentified as routine bugs.

This is especially true if the language you've chosen to write your code in is C/C++, the problem happens in an unsafe context in another language (including unexpected ones like C#). This was something I sort-of did by habit. In a past job I had a side-responsibility of tracking CVEs for any software run within a large global organization. We had a (pretty small, but surprising) incident that we were unprepared for where a bug in a Microsoft product[0] was causing a DoS on a number of sites on our intranet. It turned out to be a bug that was resolved with a service pack, but was not assigned a CVE or an MSxx-xxx number (I believe this was revised later).

From that point on, we paid special attention to a handful of apps with the rule of "If it causes a crash, it's a DoS, which makes it a security issue" followed immediately by "If we can't prove that said crash cannot lead to exploitation". Which meant that almost every little problem was being treated far more severely than it needed to be. After a while this was tempered; we did a little less research and marked those that did not have a CVE associated to simply "monitor"[1].

[0] Sorry, I searched old notes and couldn't find the one, but it was around the early Vista timeframe affecting, I think, one of the parsers used by Sharepoint ... I could have that very wrong, my eyes bled from reading so many of those.

[1] Patches, sometimes, break things. Back then, in the MS world, OS patches broke things with far greater frequency than they do today (and it was more painful to recover from), so patching a "non-problem", breaking a bunch of workstations and taking with it that employee's ability to do their job and that's a quick path to unemployment. Of course, failing to patch a known issue will lead that way too. It's a wonder many of the secops folks I've worked with are so grumpy.

Re: Rust’s standard library was vulnerable for years and nobody noticed

#16
post #10
post #8

TLDR: presumably 2 y/o (10 Jul '15) segfault bug in stdlib was discovered, fixed and merged into master on the same day on 27 Sept '17. Next release was 12 Okt '17, 15 days later. OP argues the bug should have been filed into the CVE [0] so that people who run old versions of Rust know about it and can act accordingly. [0]: https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_E... Personally I'd say running old…

This is the real point that should never be omitted from TLDR: "As a result, Debian Stable still ships vulnerable Rust versions for some architectures. I expect many enterprise users to have vulnerable versions as well."

I left it out because it seems to me OP was mistaken. Debian Stable ships with Rust 1.24.1, which is well beyond the last vulnerable version 1.20.

https://packages.debian.org/stable/rust/

Re: Rust’s standard library was vulnerable for years and nobody noticed

#17
post #9

In Go you can write unsafe code in libraries. You can even write raw assembly if you want. We had an encoding library written in a very c-ish style for maximum performance, and sure enough, it had an off-by-one error on the last byte that could've been exploited. It's funny that in severely limiting the area we could use unsafe we still somehow managed to write it improperly. If anything it serves as a reminder of wh…

Here's an example of a quite high profile Rust project discovered to have been (ab)using unsafe:

https://www.reddit.com/r/rust/comments/8s7gei/unsafe_rust_in...

Re: Rust’s standard library was vulnerable for years and nobody noticed

#18
post #16
post #10

Earlier quoted context omitted.

This is the real point that should never be omitted from TLDR: "As a result, Debian Stable still ships vulnerable Rust versions for some architectures. I expect many enterprise users to have vulnerable versions as well."

I left it out because it seems to me OP was mistaken. Debian Stable ships with Rust 1.24.1, which is well beyond the last vulnerable version 1.20. https://packages.debian.org/stable/rust/

The blog post was published on 2018-08-18. Perhaps Debian stable was shipping some other version back then?

Re: Rust’s standard library was vulnerable for years and nobody noticed

#19
post #18
post #16

Earlier quoted context omitted.

I left it out because it seems to me OP was mistaken. Debian Stable ships with Rust 1.24.1, which is well beyond the last vulnerable version 1.20. https://packages.debian.org/stable/rust/

The blog post was published on 2018-08-18. Perhaps Debian stable was shipping some other version back then?

No, it doesn't seem like it to me:

https://metadata.ftp-master.debian.org/changelogs/main/r/rus...

Re: Rust’s standard library was vulnerable for years and nobody noticed

#20
post #9

In Go you can write unsafe code in libraries. You can even write raw assembly if you want. We had an encoding library written in a very c-ish style for maximum performance, and sure enough, it had an off-by-one error on the last byte that could've been exploited. It's funny that in severely limiting the area we could use unsafe we still somehow managed to write it improperly. If anything it serves as a reminder of wh…

Here's an example of a quite high profile Rust project discovered to have been (ab)using unsafe: https://www.reddit.com/r/rust/comments/8s7gei/unsafe_rust_in...

... and, due to said awareness, the issues were all fixed. The presence of the unsafe keyword made the audit much easier. Everything is working as intended!
Post reply on HN