Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google assigns a CVE for libwebp and gives it a 10.0 score

stackdiary.com

Post reply on HN
Print view View original

41–50 of 235 posts

Re: Google assigns a CVE for libwebp and gives it a 10.0 score

#41

Post by kevincox »

jsnell wrote: post #39
kevincox wrote: post #11

The thing that concerns me most is looking at the fix it is very difficult to see why this fix is correct. It also appears as there is lots of code without explicit bounds checks. It makes me worried because while the logic may be safe this makes the logic very complex. I wonder what the cost would be to add an explicit, local bounds check at every array access. This would serve as a backup that is much easier to ver…

There was a great explanation a few days back on why the vulnerability existed, and on why the fix was correct: https://blog.isosceles.com/the-webp-0day/ (Discussed in https://news.ycombinator.com/item?id=37600852 )

I understand that the patch is correct. The point that I am trying to make is that the correctness of this code relies on non-local reasoning (the allocation/reallocation of the table before it is used). I believe that non-local reasoning raises the chance of error (and is likely one of the reasons why this bug existed in the first place).

By adding length counts and explicit bounds checks locally you provide local reasoning to back up this non-local reasoning which is much *easier* to make and maintain correct. I think that would result in code that is less likely to have similar bugs in the future.

Re: Google assigns a CVE for libwebp and gives it a 10.0 score

#42

Post by josefresco »

nickcw wrote: post #18

Android is particularly troublesome here with the number of phones out there receiving no updates, and just a single download away from being exploited. For me, personally, it's a race to see if Google can get this patched for my Pixel 5 before security updates stop in October.

Google cut off my Chromebook about 8 months back but still pushes what I'm assuming are security updates (although they've slowed as of late).

Re: Google assigns a CVE for libwebp and gives it a 10.0 score

#43

Post by matthewdgreen »

nickcw wrote: post #18

Android is particularly troublesome here with the number of phones out there receiving no updates, and just a single download away from being exploited. For me, personally, it's a race to see if Google can get this patched for my Pixel 5 before security updates stop in October.

A phone released in October 2020 is about to stop getting security updates?!

Re: Google assigns a CVE for libwebp and gives it a 10.0 score

#44

Post by JulianWasTaken »

delfinom wrote: post #34
ojii wrote: post #30

Earlier quoted context omitted.

Hubris and people thinking they can safely code in memory unsafe languages (they can't)

Not to worry, there are serialization and other vulnerabilities in memory safe languages :3

Eliminating a whole class of vulnerabilities is the right thing to do regardless of whether other classes of vulnerabilities remain.

Re: Google assigns a CVE for libwebp and gives it a 10.0 score

#45

Post by izacus »

kevincox wrote: post #41
jsnell wrote: post #39

Earlier quoted context omitted.

There was a great explanation a few days back on why the vulnerability existed, and on why the fix was correct: https://blog.isosceles.com/the-webp-0day/ (Discussed in https://news.ycombinator.com/item?id=37600852 )

I understand that the patch is correct. The point that I am trying to make is that the correctness of this code relies on non-local reasoning (the allocation/reallocation of the table before it is used). I believe that non-local reasoning raises the chance of error (and is likely one of the reasons why this bug existed in the first place). By adding length counts and explicit bounds checks locally you provide local r…

[flagged]

Re: Google assigns a CVE for libwebp and gives it a 10.0 score

#46

Post by jacquesm »

changelink wrote: post #29
nickcw wrote: post #18

Android is particularly troublesome here with the number of phones out there receiving no updates, and just a single download away from being exploited. For me, personally, it's a race to see if Google can get this patched for my Pixel 5 before security updates stop in October.

I just checked, and in the last 30 minutes a update has become available for my Pixel 5. The security bulletin doesn't reference this CVE specifically but does mention a critical vulnerability that could lead to RCE.

The problem is that they'll use the opportunity to schlep a bunch of non-security related stuff into the update as well. That's the thing that really bothers me about these, that you can't say just the security patches and hold the telemetry/marketing/spyware/adware/crapware/malware/etc.

Re: Google assigns a CVE for libwebp and gives it a 10.0 score

#47

Post by winter_blue »

kevincox wrote: post #11

The thing that concerns me most is looking at the fix it is very difficult to see why this fix is correct. It also appears as there is lots of code without explicit bounds checks. It makes me worried because while the logic may be safe this makes the logic very complex. I wonder what the cost would be to add an explicit, local bounds check at every array access. This would serve as a backup that is much easier to ver…

> ...isn't a solution to memory unsafe languages and libraries. If anything the massive amount of bugs found via fuzzing should scare us as it is likely only scratching the surface of the vulnerabilities that still lie in the code

Yup. For example, the Linux code for its relatively new[1] io_uring subsystem was so memory-exploit-ridden that Google disabled it for apps on Android, and entirely on ChromeOS, and their servers[2]. It is insane that this is how easy it has been for a person to break into Linux.

[1] released with kernel version 5.1 which came out in May 2019

[2] in June 2023: https://en.m.wikipedia.org/wiki/Io_uring#Security

Re: Google assigns a CVE for libwebp and gives it a 10.0 score

#48

Post by lukeschlather »

kevincox wrote: post #11

The thing that concerns me most is looking at the fix it is very difficult to see why this fix is correct. It also appears as there is lots of code without explicit bounds checks. It makes me worried because while the logic may be safe this makes the logic very complex. I wonder what the cost would be to add an explicit, local bounds check at every array access. This would serve as a backup that is much easier to ver…

This is the sort of thing where I am very curious to hear what happens if you fine-tune an uncensored version of GPT4 on some memory exploits like this along with the vulnerable code and ask it for more.

It seems like it ought to be really good at this and I am suspicious that people in the know are afraid to talk about it publicly because it's too good at it and once people start weaponizing LLMs for this purpose we just won't be able to use memory unsafe code anymore.

Re: Google assigns a CVE for libwebp and gives it a 10.0 score

#49

Post by matthewdgreen »

albntomat0 wrote: post #16

Additional timeline info, as I was curious myself. WebP is old enough that a memory safe language was not a feasible option when the project started. Android 12 was the first version to support Rust code, and came out in 2021 [0, link talks about the first year of integration]. On the iOS side (which also was affected by this), Swift 1.0 came out in ~2014. As far as I can tell, Chrome doesn't yet support a memory saf…

Is Rust in practice a memory safe language when you're doing tricks like decoding huffman-decoding huffman tables into buffers? It seems like once you optimize for performance this much, you're liable to turn off bounds checking here or there.

Re: Google assigns a CVE for libwebp and gives it a 10.0 score

#50

Post by aorth »

> To put this in context: if this bug does affect Android, then it could potentially be turned into a remote exploit for apps like Signal and WhatsApp. I'd expect it to be fixed in the October bulletin.

Interesting quote from Ben Hawkes (former Project Zero manager) in the article. I regularly compile Signal-Android from source and happened to notice they vendored libwebp a few days ago:

https://github.com/signalapp/Signal-Android/commit/a7d9fd19d...

Post reply on HN