Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

lists.thekelleys.org.uk

Post reply on HN
Print view View original

141–150 of 256 posts

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#141

Post by ExoticPearTree »

strenholme wrote: post #19

Shameless plug time: My own MaraDNS has been extensively audited now that we’re in the age of AI-assisted security audits. Not one single serious security bug has been found since 2023. [1] The only bugs auditers have been finding are things like “Deadwood, when fully recursive, will take longer than usual to release resources when getting this unusual packet” [2] or “This side utility included with MaraDNS, which ha…

> Shameless plug time: My own MaraDNS has been extensively audited now that we’re in the age of AI-assisted security audits.

Out of curiosty: what is the point you’re trying to make? That there are alternatives to dnsmasq? That somehow your software is “better”?

This plug provides zero value to the dnsmasq discussion.

As others have pointed out: the more used a software is, the more scrutiny it gets and more bugs or edge cases are found.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#142

Post by kiney »

jeroenhd wrote: post #28
koverstreet wrote: post #22

Earlier quoted context omitted.

No, that's exactly the thing to complain about. That whole model dates to before automated testing was even really a thing, and no one knew how to do QA; your QA was all the people willing to run your code and report bugs, and that took time. Not to mention, you think the C of today is bad? Have you looked at old C? And the disadvantage is that backporting is manual, resource intensive, and prone to error - and the p…

If you want that, you don't want Debian. Other people do. Some people will even run Debian on the desktop. I would never, but some people get real upset when anything changes. Debian does regularly bring newer versions of software: they release about every two years. If you want the latest and greatest Debian experience, upgrade Debian on week one. From your description, you seem to want Arch but made by Debian?

I run Debian on desktop and laptops. Because I want stable versions with only security backports

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#143

Post by strenholme »

shakna wrote: post #125
strenholme wrote: post #116

Earlier quoted context omitted.

Thank you for your concern. I fixed CVE-2014-5461 for Lunacy back in 2021: https://github.com/samboy/lunacy/commit/4de84e044c1219b06744... This is discussed here: https://samboy.github.io/MaraDNS/webpage/security.html#CVE-2... In addition, I have done other security hardening with Lunacy compared to Lua 5.1: https://samboy.github.io/MaraDNS/webpage/lunacy/ Now, I should probably explain why I’m using Lua 5.1 instead…

Yeah, I've had patches submitted to Moonscript, Fengari, and luau. Don't need to sell on why 5.1 is useful. Each version is a new lang, not just a few fixes or niceties. I'm not convinced that vendoring, instead of embedding, is the right way. The patch landing in 2021, instead of 2014, being one of those concerns. (And you might want to recheck your assumption of how big 'int' will be, for rg32. C defines it in term…

>>>The patch landing in 2021, instead of 2014, being one of those concerns.What makes you think I was using Lua in 2014? Seriously, do you even know how to use “git log”?

I added Lua to MaraDNS in 2020:

https://github.com/samboy/MaraDNS/commit/2e154c163a465ee7ead...

I patched it on my own in 2021:

https://github.com/samboy/MaraDNS/commit/efddb3a92b9cee30f11...

>>>you might want to recheck your assumption of how big 'int' will be

uint32_t is always 32-bit:

https://en.cppreference.com/c/types/integer

And, yes, this can be easily checked with a tiny C program:

  #include 
  #include 

  int main() {
    uint32_t foo = 0xfffffffd;
    uint64_t bar = 0xfffffffd;
    uint32_t a = 0;
    for(a=0;a
If there’s a system where uint32_t is 64 bits, that’s a bug with the compiler (which isn’t following the spec), not MaraDNS.

Are you going to make any other negative false implications about MaraDNS? Because you’re making a lot of very negative accusations without bothering to check first.

Edit: Here’s a version of the above C program which works in tcc 0.9.25:

  #include 
  #include 

  void shownum(uint64_t in) {
    int32_t a;
    for(a=60;a>=0;a-=4) {
      int n = (in >> a) & 0xf;
      if(n

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#144

Post by romaniitedomum »

BLKNSLVR wrote: post #137
romaniitedomum wrote: post #2

To quote a famous (in certain circles) bowl of petunias, "oh no, not again!"

For a number of reasons, I feel that the only way we got here was via some kind of infinite improbability drive. (mostly unrelated to topic at hand though)

> For a number of reasons, I feel that the only way we got here was via some kind of infinite improbability drive.

Oh very much so! In my mind, it seems that someone must have figured out what the universe was for, and now it's been replaced with something even more bizarre and inexplicable.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#145

Post by Terr_ »

x3n0ph3n3 wrote: post #105
unclejuan wrote: post #88

I think this is the breaking point where replacing our code written in C for code written in memory safe languages is becoming urgent. The vast majority of vulnerabilities found recently are directly related to being written in memory unsafe languages, it's very difficult to justify that a DNS/DHCP server can't be written in rust or go and without using unsafe (well, maybe a few unsafe calls are still needed, but the…

I disagree -- we're clearly getting better safeguards by way of AI agents to spot potential vulnerabilities!

A better use of LLMs: To help translate the vast majority of C/C++ developers' output into memory-safe languages. :p

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#146

Post by strenholme »

zamadatix wrote: post #129
strenholme wrote: post #60

Earlier quoted context omitted.

DJB, with Qmail and DjbDNS (as well as Publicfile, which didn’t catch on in an era of CGI scripts), showed that one could have (mostly) security bug free software without the scope being “extremely narrow”, and without the claim being “dubious”. It’s not normal for software to be so poorly written, one doubts the claim that a security bug hasn’t been found in over three years. If one thinks the claim of no security b…

I never used Qmail, so I won't comment on it, but I will say I absolutely consider djbdns narrow in scope as well (before accounting the Unix approach, utilized perhaps even more than in MaraDNS, to break that already narrowed scope down into even more focused binaries). I had believed (and continue to hold) DNS software containing, e.g., an authoritative DNS server which lacks native TCP or DNSSEC support falls squa…

The point of djbdns and qmail was this: It allowed administrators to run a local DNS server securely without needing to constantly patch the code. They were limited in scope, but were perfect for admins who valued security over features.

In an era when DNS was otherwise a monoculture, djbdns was a welcome breath of fresh air.

https://lwn.net/2001/0208/

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#147

Post by shakna »

strenholme wrote: post #143
shakna wrote: post #125

Earlier quoted context omitted.

Yeah, I've had patches submitted to Moonscript, Fengari, and luau. Don't need to sell on why 5.1 is useful. Each version is a new lang, not just a few fixes or niceties. I'm not convinced that vendoring, instead of embedding, is the right way. The patch landing in 2021, instead of 2014, being one of those concerns. (And you might want to recheck your assumption of how big 'int' will be, for rg32. C defines it in term…

>>>The patch landing in 2021, instead of 2014, being one of those concerns. What makes you think I was using Lua in 2014? Seriously, do you even know how to use “git log”? I added Lua to MaraDNS in 2020: https://github.com/samboy/MaraDNS/commit/2e154c163a465ee7ead... I patched it on my own in 2021: https://github.com/samboy/MaraDNS/commit/efddb3a92b9cee30f11... >>>you might want to recheck your assumption of how big…

> What makes you think I was using Lua in 2014? Seriously, do you even know how to use “git log”?

... It was fixed, upstream, in 2014. Thanks for not checking the number at the start of the CVE, before launching straight into attack mode.

https://www.lua.org/bugs.html#5.2.2-1

Which is the point. In 2020, when you added Lua, you added a vulnerability that had officially been fixed for six years. Because you vendored, and did not depend on any system package.

> uint32_t is always 32-bit:

Yah. Which is why I said 'int'.

As in the assumptions you made here:

https://github.com/samboy/LUAlibs/blob/master/rg32.c#L59

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#148

Post by strenholme »

z3ratul163071 wrote: post #131
strenholme wrote: post #19

Shameless plug time: My own MaraDNS has been extensively audited now that we’re in the age of AI-assisted security audits. Not one single serious security bug has been found since 2023. [1] The only bugs auditers have been finding are things like “Deadwood, when fully recursive, will take longer than usual to release resources when getting this unusual packet” [2] or “This side utility included with MaraDNS, which ha…

good job. but it is amazing we are still writing core networking tools in vulnerable language such as c in 2026.

Agreed, it made a lot more sense to write MaraDNS in C in 2001 though.

The main advantage of writing in C over Rust here in 2026 is that C has two different Lua interpreters, and there isn’t a port of Lua to Rust yet; [1] yes, there are ways to use the C version of Lua in Rust, but that’s different.

If I were to write a new server today, I could very well write it in Go, then use GopherLua for the Lua engine:

https://github.com/yuin/gopher-lua

Although, even here, the advantage of C is that I could increase performance by using LuaJIT:

https://luajit.org/luajit.html

[1] If I were to use Rust, I would consider using Rune as an embedded language as per https://rune-rs.github.io/

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#149

Post by kortilla »

strenholme wrote: post #19

Shameless plug time: My own MaraDNS has been extensively audited now that we’re in the age of AI-assisted security audits. Not one single serious security bug has been found since 2023. [1] The only bugs auditers have been finding are things like “Deadwood, when fully recursive, will take longer than usual to release resources when getting this unusual packet” [2] or “This side utility included with MaraDNS, which ha…

Flagged because this discussion about dnsmasq and another dns resolver implementation that has relatively no rollout worldwide by comparison is pointless.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#150

Post by KronisLV »

yardstick wrote: post #139
jabl wrote: post #134

Earlier quoted context omitted.

The question is whether the current situation is a short burst of action, and once those most critical bugs get fixed the hype around AI vulnerability scanning will die down, or whether the current crop of system/infra software written in vulnerable languages like C are beyond redemption and they will provide an endless source of critical bugs for AI to find until we fix them by rewriting them in Rust/Go/whatever.

An eternal summer of CVEs is upon us

Seems like those “rewrite in Rust” folks had a point after all (the viability of it for any number of projects being another thing entirely).
Post reply on HN