Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A 0-click exploit chain for the Pixel 10

projectzero.google

Post reply on HN
Print view View original

41–50 of 255 posts

Re: A 0-click exploit chain for the Pixel 10

#41

Post by ux266478 »

pavel_lishin wrote: post #30
ux266478 wrote: post #24

Earlier quoted context omitted.

I most definitely don't agree with him, and I find the idea absolutely repugnant. Devils advocate though, I would be much more careful with the code that I write if regulators passed some dogshit law like that.

I would stop writing code for money.

I understand that, though I wouldn't stop. I'd just go much slower and radically change my methodology. Failures in other engineering domains come with massive legal consequences, and they have for a very long time. In mesopotamia if a house collapsed and killed someone inside, the builder was put to death. People still built houses in the hundreds of thousands.

It really just introduces a legal burden to prove competence and work in good-faith, and nets immense power to throw out ridiculous deadlines. Your managers are legally responsible too, and if they push beyond what's reasonable you have just cause to bring them to court in a way that you currently don't. To re-emphasize, I don't think this is a better world, but it's not unlivable.

Re: A 0-click exploit chain for the Pixel 10

#42

Post by Asmod4n »

tialaramex wrote: post #31
codedokode wrote: post #7

I read about Pixel 9 Dolby Decoder bug, and it is based on integer overflow. It was a mistake to allow "+" operator to overflow, and this must be fixed in new languages like Rust, but it is not.

In Rust the decision about whether to pay for overflow checks or just wrap (because all modern hardware will just wrap if you don't check and that's cheaper) is a choice you can make when compiling software, by default you get checks except in release builds but you can choose checks everywhere, even in release builds or no checks even in debug. By definition in Rust it's incorrect to overflow the non-overflowing int…

__builtin_add_overflow Exists and it’s basically free on most CPUs out there.

Re: A 0-click exploit chain for the Pixel 10

#43

Post by pavel_lishin »

ux266478 wrote: post #41
pavel_lishin wrote: post #30

Earlier quoted context omitted.

I would stop writing code for money.

I understand that, though I wouldn't stop. I'd just go much slower and radically change my methodology. Failures in other engineering domains come with massive legal consequences, and they have for a very long time. In mesopotamia if a house collapsed and killed someone inside, the builder was put to death. People still built houses in the hundreds of thousands. It really just introduces a legal burden to prove compe…

Sure, but home builders today very rarely get put to death, and it takes a particular kind of intentional fuck-up to have a plumber, or a drywaller, or electrician placed in prison.

If I was personally liable for damages, and there was an insurance program or some sort - similar to how doctors & dentists practice - sure, I'd probably still write code, very carefully. But if there was a decent change of me spending the rest of my life in prison because something I wrote on a Friday at 4pm under some amount of stress? No thanks. I can re-train as a plumber, and stand knee-deep in shit all day.

Re: A 0-click exploit chain for the Pixel 10

#44

Post by tialaramex »

pavel_lishin wrote: post #30
ux266478 wrote: post #24

Earlier quoted context omitted.

I most definitely don't agree with him, and I find the idea absolutely repugnant. Devils advocate though, I would be much more careful with the code that I write if regulators passed some dogshit law like that.

I would stop writing code for money.

Well, one scenario would be that everybody who writes code would do so for money.

Take my friend who is a property lawyer. The firm she works for buys her insurance, because it would be insane to operate without insurance, but the only available insurance is personal insurance, it insures a specific person to do property law. So, although her day job is helping that $100Bn farm equipment company buy a $10M new factory from a $100Bn construction firm, at the weekend she is covered by that same insurance when she represents her friend buying a $500k cottage. AIUI this is a completely normal arrangement.

If that was the situation for programming, the company is going to buy your $100M exploit insurance because they need a programmer, but it's personal insurance so you could work on your Game jam game using the same insurance, and it'd be crazy to just "Go commando" if you don't have employment and thus insurance, in case somehow your "Galaga but also Blue Prince and somehow a visual novel" Game jam entry causes a $10M damages payment.

Re: A 0-click exploit chain for the Pixel 10

#45

Post by jayd16 »

seanieb wrote: post #25
deaton wrote: post #22

Earlier quoted context omitted.

This is pure guesswork, I am not a security researcher, but my guess would be that AI is increasing the amount of low quality exploitable attack surface available, while simultaneously providing security researchers with an accelerant for their work. Which is to say, its great if you use it well and really bad if you use it poorly.

Not low quality if it works!

The low quality refers to the features with security holes. So no, it didn't work (in this hypothetical).

Re: A 0-click exploit chain for the Pixel 10

#46

Post by hombre_fatal »

lifis wrote: post #13
shay_ker wrote: post #3

Hmmm... I'd like someone to double check my thinking here. I posted this exact prompt for gpt 5.5 xhigh: ``` does this look right to you? don't do any searches or check memory, just think through first principles static int vpu_mmap(struct file fp, struct vm_area_struct vm) { unsigned long pfn; struct vpu_core core = container_of(fp->f_inode->i_cdev, struct vpu_core, cdev); vm_flags_set(vm, VM_IO | VM_DONTEXPAND | VM…

[flagged]

We should roll this out for everything.

Someone T-bones you in parking lot, chef causes food poisoning, plumber's leak floods your bathroom, personal trainer pushes to injury, mislabeled allergen on food, movers break your armoire, roofer leaves a leak -- I bet we'd see a lot less of all that if a $1MM fine + life in jail loomed over everyone.

Nobody would want to do business, but boy would we be in a golden age.

Re: A 0-click exploit chain for the Pixel 10

#47

Post by empath75 »

shay_ker wrote: post #3

Hmmm... I'd like someone to double check my thinking here. I posted this exact prompt for gpt 5.5 xhigh: ``` does this look right to you? don't do any searches or check memory, just think through first principles static int vpu_mmap(struct file fp, struct vm_area_struct vm) { unsigned long pfn; struct vpu_core core = container_of(fp->f_inode->i_cdev, struct vpu_core, cdev); vm_flags_set(vm, VM_IO | VM_DONTEXPAND | VM…

I pasted the code into claude Opus 4.7 with no internet access and just asked it to just tell me what the function did, and it explained it and also called out the bug. I did not tell it to look for bugs:

> Observations & Potential Issues A few things worth flagging: 1. No bounds checking on the mapping size. Userspace controls vm_end - vm_start and vm->vm_pgoff. Here vm_pgoff is ignored entirely and the size is trusted blindly. If the VPU's register block is, say, 64KB but userspace requests a 1MB mapping, the driver will happily map 1MB of physical address space starting at core->paddr — potentially exposing whatever hardware happens to live at adjacent physical addresses. A defensive check would be:

---

70 day release cycles are very quickly not going to be fast enough to stop widespread use of exploits when you have bots able to scan every PR on every open source project as it comes out.

Re: A 0-click exploit chain for the Pixel 10

#48

Post by creaturemachine »

hombre_fatal wrote: post #46
lifis wrote: post #13

Earlier quoted context omitted.

[flagged]

We should roll this out for everything. Someone T-bones you in parking lot, chef causes food poisoning, plumber's leak floods your bathroom, personal trainer pushes to injury, mislabeled allergen on food, movers break your armoire, roofer leaves a leak -- I bet we'd see a lot less of all that if a $1MM fine + life in jail loomed over everyone. Nobody would want to do business, but boy would we be in a golden age.

A golden age of prisons and debt collectors.

Re: A 0-click exploit chain for the Pixel 10

#49

Post by mrgoldenbrown »

StilesCrisis wrote: post #20
lifis wrote: post #13

Earlier quoted context omitted.

[flagged]

If this rule were implemented, would you be walking free right now? Think it over.

Pretty sure the million dollars was not meant seriously. There are plenty of regulated fields in which people still participate, despite various risks of liability. Professional engineers, doctors, every Uber driver in the US, who could potentially be punished for negligent driving while on the job. The point, I think, is that the current level of responsibility for writing bad code is essentially zero, but should probably be higher for some applications.

Re: A 0-click exploit chain for the Pixel 10

#50

Post by tialaramex »

Asmod4n wrote: post #42
tialaramex wrote: post #31

Earlier quoted context omitted.

In Rust the decision about whether to pay for overflow checks or just wrap (because all modern hardware will just wrap if you don't check and that's cheaper) is a choice you can make when compiling software, by default you get checks except in release builds but you can choose checks everywhere, even in release builds or no checks even in debug. By definition in Rust it's incorrect to overflow the non-overflowing int…

__builtin_add_overflow Exists and it’s basically free on most CPUs out there.

> __builtin_add_overflow Exists and it’s basically free on most CPUs out there.

This is a very C-flavoured "solution". For those who haven't seen it this involves a pointer (!) and we're going to compute the addition, write the result to the pointed-at integer and then if that didn't fit and so it overflowed we'll return true otherwise false.

The closest Rust analogy would be T::carrying_add which returns a pair to achieve a similar result.

And yeah, checking is "basically free" unless it isn't, that's not different. If you haven't measured you don't know, same in every programming language.

It's never been true that you can't write correct software in C or C++ the problem is that in practice you won't do so.

Post reply on HN