Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

lists.thekelleys.org.uk

Post reply on HN
Print view View original

151–160 of 256 posts

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#151

Post by strenholme »

shakna wrote: post #147
strenholme wrote: post #143

Earlier quoted context omitted.

>>>The patch landing in 2021, instead of 2014, being one of those concerns. What makes you think I was using Lua in 2014? Seriously, do you even know how to use “git log”? I added Lua to MaraDNS in 2020: https://github.com/samboy/MaraDNS/commit/2e154c163a465ee7ead... I patched it on my own in 2021: https://github.com/samboy/MaraDNS/commit/efddb3a92b9cee30f11... >>>you might want to recheck your assumption of how big…

> What makes you think I was using Lua in 2014? Seriously, do you even know how to use “git log”? ... It was fixed, upstream, in 2014. Thanks for not checking the number at the start of the CVE, before launching straight into attack mode. https://www.lua.org/bugs.html#5.2.2-1 Which is the point. In 2020, when you added Lua, you added a vulnerability that had officially been fixed for six years. Because you vendored,…

Apologies for being confrontational; accusations of there being security holes are serious accusations in my book, and need to be backed up with solid facts. Yes, that’s how seriously I take security with the software I make available on the Internet.

That number is a 32-bit number in the C code, but it’s converted in to a 16-bit number. I used “int” to have it interface with other Lua code, but safely assume “int” can fit 16 bits, and yes I do convert the number to a 16-bit one before passing it off to other Lua code:

https://github.com/samboy/LUAlibs/blob/master/rg32.c#L77

Here, I assume lua_number can pass 32 bits:

https://github.com/samboy/LUAlibs/blob/master/rg32.c#L45

https://github.com/samboy/MaraDNS/blob/master/coLunacyDNS/lu...

https://github.com/samboy/lunacy/blob/master/src/lmathlib.c#...

But it works without issue:

  rg32.randomseed("shakna3")
  print(string.format("%x",rg32.rand32()))
One sees “b0e6725c”, i.e. a 32-bit unsigned number

Likewise:

  rg32.randomseed("shakna3")
  print(string.format("%x %x",rg32.rand16(),rg32.rand16()))
Gives us “b0e6 725c”.

Vendoring Lua 5.1 was forced; since I wanted to use Lua 5.1 (for reasons described above, e.g. LuaJIT compatibility), I had to use code which hasn’t been updated upstream since 2012.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#152

Post by strenholme »

fc417fc802 wrote: post #80
strenholme wrote: post #75

Earlier quoted context omitted.

I have far more evidence of a very good security record with MaraDNS than “No bugs in 3 years in this software with a much smaller audience and also look AI audits!” • The software has been around for 25 years • The software is popular enough to have been subjected to dozens of security code audits, including two audits in the post-AI era • In those 25 years, only two remote “packet of death” bugs have been found • A…

For what it's worth I didn't know about maradns prior to this. Maybe it actually sees fairly wide use? Whether or not I accept your evidence would hinge on that. Regardless I think my point stands - if you don't lead with a convincing line of reasoning all that's left is an empty assertion. Unless I happen to recognize you as an authority in the field that's not going to do anything for me since by default you're som…

“The software has to present a worthwhile target (ie have a substantial long term userbase) before anyone will bother to look for exploits”

MaraDNS is a worthwhile target; two people have been auditing it this year, in fact:

https://github.com/samboy/MaraDNS/pull/137

https://github.com/samboy/MaraDNS/security/advisories/GHSA-c...

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#153

Post by Baltazhar »

What is the nature of these findings? There’s a big difference between AI finding a buffer overflow vs. identifying a fundamental protocol flaw. Could AI realistically discover something like the Kaminsky attack? or even something which is an amplification exploit like the NXNSAttack?

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#154

Post by lionkor »

Terr_ wrote: post #145
x3n0ph3n3 wrote: post #105

Earlier quoted context omitted.

I disagree -- we're clearly getting better safeguards by way of AI agents to spot potential vulnerabilities!

A better use of LLMs: To help translate the vast majority of C/C++ developers' output into memory-safe languages. :p

You're likely joking, but in case someone else misunderstands; this is not going to work. Rust with unsafe{} is the only thing you can translate directly to, even with LLMs. Rust with extensive unsafe{} is not something anyone wants to debug or maintain, and is near impossible to improve quickly.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#155

Post by turpentine »

unclejuan wrote: post #88

I think this is the breaking point where replacing our code written in C for code written in memory safe languages is becoming urgent. The vast majority of vulnerabilities found recently are directly related to being written in memory unsafe languages, it's very difficult to justify that a DNS/DHCP server can't be written in rust or go and without using unsafe (well, maybe a few unsafe calls are still needed, but the…

https://news.ycombinator.com/item?id=47943499 - 44 CVEs trying to replace coreutils with a greenfield rust rewrite. There's no free lunch.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#156

Post by Yokohiii »

unclejuan wrote: post #88

I think this is the breaking point where replacing our code written in C for code written in memory safe languages is becoming urgent. The vast majority of vulnerabilities found recently are directly related to being written in memory unsafe languages, it's very difficult to justify that a DNS/DHCP server can't be written in rust or go and without using unsafe (well, maybe a few unsafe calls are still needed, but the…

The problem is the lack of talent that is willing to work on this, not the language.

AI Security researchers at least do something. If it was so easy to rewrite everything in rust, I don't know why the response to this incidents isn't a rock solid replacement in rust, the next day.

I tell you why that is. Working on these things doesn't give you stars on github.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#157

Post by PunchyHamster »

washingupliquid wrote: post #8

Maybe this is the kick in the ass Debian needs to upgrade the embarrassingly ancient dnsmasq in "stable" because while I can't think of any new features, the latest versions contain many non-CVE bug fixes. But I doubt it, they will lazily backport these patches to create some frankenstein one-off version and be done with it. Before anyone says "tHaT's wHaT sTaBlE iS fOr": they have literally shipped straight-up broke…

whatever you're on, stop, it's not making your brain any better

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#158

Post by PunchyHamster »

braiamp wrote: post #24
wolttam wrote: post #18

Earlier quoted context omitted.

Looks like the version in stable is 2.91, which was released within a couple months of trixie. It's not 'ancient' by any stretch. FWIW the fixes referenced here are already fixed in trixie: https://security-tracker.debian.org/tracker/source-package/d...

Yeah was about to comment, parent says "if it is ancient", it is not. So the root comment is nothing burger. Stable has 1 release cycle old, and depending on how things play out, testing may have 2.93 or later anyways.

2.92 currently

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#159

Post by PunchyHamster »

jeroenhd wrote: post #28
koverstreet wrote: post #22

Earlier quoted context omitted.

No, that's exactly the thing to complain about. That whole model dates to before automated testing was even really a thing, and no one knew how to do QA; your QA was all the people willing to run your code and report bugs, and that took time. Not to mention, you think the C of today is bad? Have you looked at old C? And the disadvantage is that backporting is manual, resource intensive, and prone to error - and the p…

If you want that, you don't want Debian. Other people do. Some people will even run Debian on the desktop. I would never, but some people get real upset when anything changes. Debian does regularly bring newer versions of software: they release about every two years. If you want the latest and greatest Debian experience, upgrade Debian on week one. From your description, you seem to want Arch but made by Debian?

Debian Testing works just fine on desktop and it is up to date enough to not really be an issue.

And despise the name is probably more stable than vast majority of rolling release distros

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#160

Post by Orygin »

turpentine wrote: post #155
unclejuan wrote: post #88

I think this is the breaking point where replacing our code written in C for code written in memory safe languages is becoming urgent. The vast majority of vulnerabilities found recently are directly related to being written in memory unsafe languages, it's very difficult to justify that a DNS/DHCP server can't be written in rust or go and without using unsafe (well, maybe a few unsafe calls are still needed, but the…

https://news.ycombinator.com/item?id=47943499 - 44 CVEs trying to replace coreutils with a greenfield rust rewrite. There's no free lunch.

How many CVEs in coreutils over the years? The project has the advantage of being old enough for them to be fixed. Call me when the rust rewrite has been there that long and still has more CVEs than the GNU counterpart.
Post reply on HN