Can anyone find the mailing list thread on this topic (or does it not exist because @security are private mailing list)?
I did find another use-after-free bug from a couple months ago on the mailing list:
OpenBSD has a use-after-free allowing local privilege escalation to root
21–30 of 170 posts
Re: OpenBSD has a use-after-free allowing local privilege escalation to root
#22Oh, hey, a local-user-to-root exploit on OpenBSD. Cool! Those are rare, but not unheard of, unless you're talking about Windows or Linux, where you don't hear much about this bug class, just since it's common-as-rainfall.
Anyway... Does this mean OpenBSD is suddenly less interesting? Nope, it's still pretty much the best-understandable general-purpose OS, ready for your RiiR fork. So, still go for that! Burn a universe or two worth of tokens! For the planet!
Does this mean OpenBSD is suddenly less secure? Nah... Its practical security level was never that much higher than that of its nominal competitors, despite Theo's best attempts, the best of which were replicated elsewhere and majority of it went ignored. The first class counts as "innovations", the rest as "experiments" which, no matter what anyone thinks, is not the same as "failed innovations."
But I digress. Now, go and donate to OpenSSH (because I bet you typed ssh today, didn't you, you rascal?), publish your OxidizedBSD fork, or whatever. Just don't link to that "is OpenBSD secure?" site, because, well, gauche, dude(tte)!
Re: OpenBSD has a use-after-free allowing local privilege escalation to root
#23OpenBSD's security stance being the stuff of legend, I'm curious how many vulns have been found over the last couple months while the big model companies are flaunting their ability to find exploits. It'd be super cool to see it remain tiny.
According to https://openai.com/index/patch-the-planet/ Linux: 24 LPEs, plus many additional vulnerabilities. OpenBSD: 1 LPE. FreeBSD: 7 LPEs, plus many additional vulnerabilities. Not sure what that says, though. Perhaps the models are more likely to find Linux issues because of the training.
Or Linux development is significantly more active.
Re: OpenBSD has a use-after-free allowing local privilege escalation to root
#24[flagged]
Tell us you know nothing about kernel programming and trust stacks while you are at it.
Re: OpenBSD has a use-after-free allowing local privilege escalation to root
#25Would Rust have made this issue impossible by construction? I know Linus has spoken about Rust's promises about memory safety not being equivalently applicable in the kernel domain, so I would be curious to hear any kernel developer's perspectives.
I’m not an OS programmer and have been dabbling with OpenBSD’s code for fun. But the fact is that Rust kinda lacks flexibility. Most of the OS is dedicated to building a beautiful lie for programs to run happily, and that’s where C shine.
I shudder to think about the amount of work that it would take to convince the rust compiler that everything is all right. Most hardware interactions is “parse, don’t validate” which means you’ll be pinky-swearing to the compiler.
And for my cursory glances at the code, most structures are handled well, that it’s mostly logic bug (from bad data) instead of bad memory access (which can happen).
Re: OpenBSD has a use-after-free allowing local privilege escalation to root
#26Earlier quoted context omitted.
According to https://openai.com/index/patch-the-planet/ Linux: 24 LPEs, plus many additional vulnerabilities. OpenBSD: 1 LPE. FreeBSD: 7 LPEs, plus many additional vulnerabilities. Not sure what that says, though. Perhaps the models are more likely to find Linux issues because of the training.
Or Linux development is significantly more active.
This is an external audit. Why would Linux activity make a difference here? Are you theorizing that the churn causes bugs?
Re: OpenBSD has a use-after-free allowing local privilege escalation to root
#27OpenBSD's security stance being the stuff of legend, I'm curious how many vulns have been found over the last couple months while the big model companies are flaunting their ability to find exploits. It'd be super cool to see it remain tiny.
I think of it more as their attention to quality in their code:
Given the 'quality' of most code, especially under commercial pressure, it's no surprise that much more effective tools will find many more vulnerabilities. Did OpenBSDs quality approach work in this respect?
Re: OpenBSD has a use-after-free allowing local privilege escalation to root
#28OpenBSD's security stance being the stuff of legend, I'm curious how many vulns have been found over the last couple months while the big model companies are flaunting their ability to find exploits. It'd be super cool to see it remain tiny.
According to https://openai.com/index/patch-the-planet/ Linux: 24 LPEs, plus many additional vulnerabilities. OpenBSD: 1 LPE. FreeBSD: 7 LPEs, plus many additional vulnerabilities. Not sure what that says, though. Perhaps the models are more likely to find Linux issues because of the training.
I wonder how many of the Linux the LPEs are related to drivers, which I understand there are more of..
Re: OpenBSD has a use-after-free allowing local privilege escalation to root
#29Would Rust have made this issue impossible by construction? I know Linus has spoken about Rust's promises about memory safety not being equivalently applicable in the kernel domain, so I would be curious to hear any kernel developer's perspectives.
The Rust ownership model prevents use after free. This type of a bug would not compile.
You might not be able to express the ownership in the way that can be checked statically, so quite possibly this would then be downgraded to a runtime error (that could be handled with a panic)—but not undefined behavior.
Re: OpenBSD has a use-after-free allowing local privilege escalation to root
#30Would Rust have made this issue impossible by construction? I know Linus has spoken about Rust's promises about memory safety not being equivalently applicable in the kernel domain, so I would be curious to hear any kernel developer's perspectives.
The Rust ownership model prevents use after free. This type of a bug would not compile.
Not necessarily. Rust safety relies on OS primitives and the error here is in an OS primitive itself (kernel semaphores).
Yes Rust is one language that can be widely deployed in systems programming and potentially avoid classes of memory and ownership errors. No it doesn’t magically solve all the problems. Saying “Rust would fix this” in a hypothetical situation where Rust existed in 1995 or OpenBSD was rewritten from scratch, ok, well maybe. As of today only research kernels and a very small fraction of Linux systems have been written in Rust when we are talking about kernels.
People without systems and embedded programming experience need to sit down.