Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)

ze3tar.github.io

Post reply on HN
Print view View original

121–130 of 152 posts

Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)

#121

Post by mattstir »

onjectic wrote: post #101
Gigachad wrote: post #68

Earlier quoted context omitted.

Government agencies probably already have half of these exploits in their private toolbox for years now. Finding and patching them is good, but there probably needs to be some systematic change to prevent them rather than just patching bugs when they get found.

Something something microkernels + capability-based security.

I've seen microkernels mentioned a few times between these LPE posts and I'm curious about why. Would they be fundamentally more secure against forgetting to add bounds checking, or assuming user-provided input buffers should be writable without checking?

Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)

#122

Post by saghm »

skydhash wrote: post #102
kibwen wrote: post #97

Earlier quoted context omitted.

> To err is human Yes, which is precisely why I write in Rust, because the compiler errs less than I do.

It may, but it still requires careful annotations. So you should hope that you have not made an error there and described the wrong structure for the code.

It seems like you have this backwards. Messing up lifetimes in safe Rust can't cause unsafety; the compiler checks if the lifetimes are valid, and if they're not, you get a compiler error. You don't need to "hope" you did it right because the entire point is that you can't compile if you didn't.

On the other hand, when you're relying on your ability to "actually write quite good C code"...you'd better hope that you have not made an error there. In practice, some of the most widely used C libraries in the world still seem to have bugs like this, so I don't really understand why you'd think that's a winning strategy.

Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)

#123

Post by zipy124 »

sva_ wrote: post #76
rishabhaiover wrote: post #5

What is happening? I see multiple outages and CVEs is being reported on HN's front page. I've never seen these many security/incident related posts on HN's front page.

A mix of AI and hybrid warfare.

Yes I think people forget that cyber-war between West and East is very active, with a significant amount of attacks being committed by nation states or state-sponsored groups.

Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)

#124

Post by saghm »

dralley wrote: post #67
dvt wrote: post #54

Earlier quoted context omitted.

Let's say you want to call win32 (or Mac) OS functions, all of a sudden you're doing all kinds of wonky pointer stuff because that's how these operating systems have been architected. Doing unsafe stuff is pretty inevitable if you want to do anything non-hello-world-ish.

A tiny fraction of programs need to use win32 or Mac OS functions beyond the standard library or other safe wrappers for said functions.

And even in those programs, only a fraction of the code in them is actually directly making calls to those APIs! Having everything else in safe code still makes it easier to audit than if the entire codebase is in C or C++.

Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)

#125

Post by saghm »

steveklabnik wrote: post #94
overfeed wrote: post #81

Earlier quoted context omitted.

> 95% of rust is safe rust. Based on the raw number of assorted crates, which has no bearing on kernel code. The more relevant question is, can a performant, cross-architecture, kernel ring-buffer be written in safe Rust?

Hubris, an embedded RTOS-like used in production by Oxide, has ~4% unsafe code in the kernel last I checked. There’s a ring buffer implementation that has one unsafe, for unchecked indexing: https://github.com/oxidecomputer/hubris/blob/master/lib/ring... (this of course does not mean that it is the one ring buffer to rule them all, but it’s to demonstrate that yes, it is at least possible to have one with minimum uns…

I've always had the impression that people who haven't actually tried to write low-level code in Rust to try to find out where the actual boundary of where they would need unsafe is tend not to realize how far you can push something and build safe abstractions on top of it. Almost every time I've had to wrap an unsafe API, I've been able to find a way to eliminate at least one of the invariants that are documented as needed for safety from propagating upwards, and there have been plenty of times that the specific circumstances of my use-case allowed me to eliminate it entirely.

The entirety of safe Rust is built upon unsafe Rust that's abstracted like this. The fact that you sometimes need unsafe isn't a mark against Rust, but literally the entire premise of the language and the exact problem it's designed to solve.

Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)

#127

Post by nly »

overboard2 wrote: post #95
elija wrote: post #92

Earlier quoted context omitted.

In some sense, I wonder if non-open-source is "safer" since LLMs can't mass scan the code for exploits.

Maybe for a while, but there's nothing stopping LLMs from examining disassembler output.

That's significantly more challenging for an LLM (and a human)

Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)

#128

Post by Gigachad »

mattstir wrote: post #121
onjectic wrote: post #101

Earlier quoted context omitted.

Something something microkernels + capability-based security.

I've seen microkernels mentioned a few times between these LPE posts and I'm curious about why. Would they be fundamentally more secure against forgetting to add bounds checking, or assuming user-provided input buffers should be writable without checking?

Yes, because as a userspace program if you forget to do bounds checking or read the wrong thing, the kernel kills the process. But if the buggy code is the kernel then there’s no protection. Microkernels aim to have as little code as required in kernel space.

Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)

#129

Post by lsaferite »

nly wrote: post #127
overboard2 wrote: post #95

Earlier quoted context omitted.

Maybe for a while, but there's nothing stopping LLMs from examining disassembler output.

That's significantly more challenging for an LLM (and a human)

I would caution against thinking it's difficult for an LLM. I've used them in raw data file analysis and they are frequently shockingly good at pulling structures and meaning out of seemingly random data. Disassembled binaries already are structured, so pulling code flow out of that is easier. Mixing that with existing disassembly and inspection tooling and an LLM has what is needed to fast track this kind of vulnerability research. Point being, an LLM with the proper tools can potentially follow code flow from disassembled binaries way easier than a human.

Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)

#130

Post by Aurornis »

sva_ wrote: post #76
rishabhaiover wrote: post #5

What is happening? I see multiple outages and CVEs is being reported on HN's front page. I've never seen these many security/incident related posts on HN's front page.

A mix of AI and hybrid warfare.

Warfare does not look like releasing neatly documented vulnerability reports to the public.
Post reply on HN