Earlier quoted context omitted.
Google invests heavily in sanitizers. It funded the development of the ones that ship with LLVM.
Yes, I know. My question was more if or why a sanitizer doesn't help.
Google pushes emergency Chrome update to fix 8th zero-day in 2022
41–50 of 51 posts
Re: Google pushes emergency Chrome update to fix 8th zero-day in 2022
#42Earlier quoted context omitted.
Yes, I know. My question was more if or why a sanitizer doesn't help.
Not always, see https://googleprojectzero.blogspot.com/2021/12/this-shouldnt...
My understanding though is that the ASAN would have done its job, had the test checked for the results. Quoting from the post:
> This fuzzer might have produced a SECKEYPublicKey that could have reached the vulnerable code, but as the result was never used to verify a signature, the bug could never be discovered.
If the result had been used, the ASAN would have kicked in, I guess, or?
Re: Google pushes emergency Chrome update to fix 8th zero-day in 2022
#43Earlier quoted context omitted.
Not always, see https://googleprojectzero.blogspot.com/2021/12/this-shouldnt...
My understanding though is that the ASAN would have done its job, had the test checked for the results. Quoting from the post: > This fuzzer might have produced a SECKEYPublicKey that could have reached the vulnerable code, but as the result was never used to verify a signature, the bug could never be discovered. If the result had been used, the ASAN would have kicked in, I guess, or?
Well, it is a lot of conditionals, and in any case binaries are seldom shipped with ASAN into production, so it would still be a lottery outcome if the fuzzer would have generated that specific use case.
Re: Google pushes emergency Chrome update to fix 8th zero-day in 2022
#44Earlier quoted context omitted.
> people (white or black hats) I've just realized that these terms may also be subject to the crazy "every word is racism" movement these days. shudders
I think that stopped a few years ago when people realized it wasn't reasonable.
Did we? Renaming the master branch was clearly ridiculous but everything is still moving over to main. I think we are in for a never ending series of name changes.
Re: Google pushes emergency Chrome update to fix 8th zero-day in 2022
#45Earlier quoted context omitted.
sanitizers don't work because they only check the paths that you actually run them on. vulnerabilities come from the weird combination of edge cases you didn't test.
Thanks. I thought so too, I just wanted to have some confirmation. It's not that they don't find issues, but it's more of a coverage issue then? (In which case I really understand, someone said it's 25 million lines of code...)
it's not even line coverage. to be secure you need to be secure for every combination of branches. at 25 million lines of code, hitting every if/else combination would take longer than the lifetime of the universe.
Re: Google pushes emergency Chrome update to fix 8th zero-day in 2022
#46Earlier quoted context omitted.
Memory issues and JIT bugs mostly :) https://microsoftedge.github.io/edgevr/posts/Super-Duper-Sec... >Looking at CVE (Common Vulnerabilities and Exposures) data after 2019 shows that roughly 45% of CVEs issued for V8 were related to the JIT engine. Moreover, we know that attackers weaponize and abuse these bugs as well; an analysis from Mozilla shows that over half of the “in the wild” Chrome exploits abused a JIT bu…
How Rust's memory safety can help to solve JIT generating bug code? BTW Chromium is testing rewriting critical parts in Rust ( https://chromium.googlesource.com/chromium/src/+/refs/heads/... )
I said that turning off JIT with two a few clicks makes your browser significantly more secure
Rust is an improvement to memory related issues
Re: Google pushes emergency Chrome update to fix 8th zero-day in 2022
#47Honest question: where do all of the new zero day vulnerabilities come from, new features/code? Just new bug detection techniques? I'd think over time entropy would get us to a point where there's hardly any vulnerabilities at all, but that's clearly not the case.
Memory issues and JIT bugs mostly :) https://microsoftedge.github.io/edgevr/posts/Super-Duper-Sec... >Looking at CVE (Common Vulnerabilities and Exposures) data after 2019 shows that roughly 45% of CVEs issued for V8 were related to the JIT engine. Moreover, we know that attackers weaponize and abuse these bugs as well; an analysis from Mozilla shows that over half of the “in the wild” Chrome exploits abused a JIT bu…
> you can literally turn off JIT with a few clicks
Am I the only one not able to see this for browsers other than Microsoft Edge?
Disabling JIT looks like cli flags only for Chrome/Brave/etc, which isn't activated when you've clicked on a link outside the browser or other methods for launching the default browser application, probably the most important times for security as it's often initiating login flows for apps or password resets.
Additionally it disables WASM, whereas Edge has alternate means to run WASM with JIT disabled.
Pretty disappointing to see from Google given the sheer extent of other in-browser settings flags.
Re: Google pushes emergency Chrome update to fix 8th zero-day in 2022
#48Honest question: where do all of the new zero day vulnerabilities come from, new features/code? Just new bug detection techniques? I'd think over time entropy would get us to a point where there's hardly any vulnerabilities at all, but that's clearly not the case.
Memory issues and JIT bugs mostly :) https://microsoftedge.github.io/edgevr/posts/Super-Duper-Sec... >Looking at CVE (Common Vulnerabilities and Exposures) data after 2019 shows that roughly 45% of CVEs issued for V8 were related to the JIT engine. Moreover, we know that attackers weaponize and abuse these bugs as well; an analysis from Mozilla shows that over half of the “in the wild” Chrome exploits abused a JIT bu…
What percentage of the total code in Chromium is the JIT?
(acknowledging that this is a very fuzzy question)
Re: Google pushes emergency Chrome update to fix 8th zero-day in 2022
#49Earlier quoted context omitted.
Google invests heavily in sanitizers. It funded the development of the ones that ship with LLVM.
Yes, I know. My question was more if or why a sanitizer doesn't help.
Sanitizers do help, but they can't catch all bugs. They need to execute a buggy code path to catch issues, and even then they're not perfect.
Re: Google pushes emergency Chrome update to fix 8th zero-day in 2022
#50Earlier quoted context omitted.
How Rust's memory safety can help to solve JIT generating bug code? BTW Chromium is testing rewriting critical parts in Rust ( https://chromium.googlesource.com/chromium/src/+/refs/heads/... )
I said that turning off JIT with two a few clicks makes your browser significantly more secure Rust is an improvement to memory related issues
Rust seems to provide memory safety built-in that is still possible in C++ with appropriate linters / static analysis (e.g., don't ever assign a `new` pointer to anything other than a unique one). I remember Google's codebase generally being good on this, but does Chromium not follow that?
My guess is yes and these are issues that would affect both languages equally, with Rust it just happens to be in an `unsafe` block.