[flagged]
And you see a lot of other languages being used to create operating systems with complicated multiprocessor and locking semantics?
You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)
61–70 of 152 posts
Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)
#62What is happening? I see multiple outages and CVEs is being reported on HN's front page. I've never seen these many security/incident related posts on HN's front page.
Perhaps it was the prior quiescent period that was the anomaly.
Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)
#63Earlier quoted context omitted.
But one would have to explicitly choose to use unsafe Rust for this instead of ordinary safe Rust. And safe Rust has no particular difficulty writing to slots in an array or slice or vector specified by their index.
except nearly everyone uses unsafe rust
No they really don't. 95% of rust is safe rust[1].
Also unsafe rust doesn't remove bounds checks. arr[idx] is bounds checked in every context.
You can opt out of array bounds checking by writing unsafe { arr.get_unchecked(idx) } . But thats incredibly rare in practice.
[1] https://cs.stanford.edu/~aozdemir/blog/unsafe-rust-syntax/
Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)
#64Earlier quoted context omitted.
> except nearly everyone uses unsafe rust Really? Why? I've not used Rust outside of some fairly small efforts, but I've never found a reason to reach for unsafe. So why is "nearly everyone" else using it?
Let's say you want to call win32 (or Mac) OS functions, all of a sudden you're doing all kinds of wonky pointer stuff because that's how these operating systems have been architected. Doing unsafe stuff is pretty inevitable if you want to do anything non-hello-world-ish.
Making use of win32 functions doesn't turn off bounds checking in your rust code.
Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)
#65Earlier quoted context omitted.
Automated vulnerability discovery via LLM.
Anyone care to share which models and which prompts actually lead to finding these kinds of vulnerabilities? Or the narrowing-down workflow that can get an LLM to discover them? Surely just telling claude "Find all vulnerabilities in this project LOL" isn't enough? I hope?
[dead]
Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)
#66How many systems have the relevant NICs, and followed the non-automatic setup steps in https://docs.kernel.org/networking/iou-zcrx.html, and are not running within a VM/container disabling io_uring?
This seems on the low impact end of the numerous historical io_uring issues.
Interesting and important all the same.
Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)
#67Earlier quoted context omitted.
> except nearly everyone uses unsafe rust Really? Why? I've not used Rust outside of some fairly small efforts, but I've never found a reason to reach for unsafe. So why is "nearly everyone" else using it?
Let's say you want to call win32 (or Mac) OS functions, all of a sudden you're doing all kinds of wonky pointer stuff because that's how these operating systems have been architected. Doing unsafe stuff is pretty inevitable if you want to do anything non-hello-world-ish.
A tiny fraction of programs need to use win32 or Mac OS functions beyond the standard library or other safe wrappers for said functions.
Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)
#68Another one. Linux is falling apart faster than it can assign these CVEs.
Falling apart? You mean getting stronger? Every single one of these is an existing hole being patched. It isn't making new holes
Government agencies probably already have half of these exploits in their private toolbox for years now. Finding and patching them is good, but there probably needs to be some systematic change to prevent them rather than just patching bugs when they get found.
Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)
#69Earlier quoted context omitted.
Automated vulnerability discovery via LLM.
Anyone care to share which models and which prompts actually lead to finding these kinds of vulnerabilities? Or the narrowing-down workflow that can get an LLM to discover them? Surely just telling claude "Find all vulnerabilities in this project LOL" isn't enough? I hope?
The Anthropic researchers have said their flow is as simple as:
1. Pick a file to seed as a starting place.
2. Ask the LLM (in an agent harness) to find a vulnerability by starting there.
3. If it claims to have found something, ask another one to create an exploit/verify it/prove it or whatever.
4. If both conclude there is a vuln, then with the latest models you almost certainly found something real.
Just run it against every file in a repo, or select a subset, or have an LLM select files with a simple "what X files look likely to have vulns?".
So basically yes, it is that simple. It's just a matter of having the money to pay for the tokens.
Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)
#70Earlier quoted context omitted.
But one would have to explicitly choose to use unsafe Rust for this instead of ordinary safe Rust. And safe Rust has no particular difficulty writing to slots in an array or slice or vector specified by their index.
except nearly everyone uses unsafe rust
"unsafe Rust" is not a binary; you don't opt into it for every single line of code. Given that the entire premise behind the idea that using C instead of Rust is fine is that people should be able to pay close attention and not make mistakes like this, having the number of places you need to look be a tiny fraction of the overall code that's explicitly marked as unsafe is a massive difference from C where literally every line of the code could be hiding stuff like this.