61–68 of 68 posts
Earlier quoted context omitted.
That’s not how software teams work unfortunately. There’s probably three build systems and none of them work on certain days of the week and the guy who wrote it all left six months ago.
For XNU? Doubt it. It's probably all on XBS and has multiple people maintaining the build system.
TL;DR: Heap buffer overflow in the network stack allowed for sending ICMP packets that would crash devices. Bug was marked as "RCE" because it's possible that it could be used for code execution, though the current PoC only causes a crash. Bug has been reported to Apple and fixed in iOS 12 and macOS Mojave 10.14. There's an excellent drawing by the author at the end of the author summarizing the exploit ;) As an asid…
> Heap buffer overflow in the network stack allowed for sending ICMP packets that would crash devices. It's not receiving an ICMP packet that causes the crash, it's when sending an ICMP error response packet. ICMP error packets can be generated in response to any type of IP packet, for example "host unreachable" when using UDP. These packets copy the original header of the packet which generated the error, which is w…
I expect to see a PoC soon with arbitrary code execution in kernel space on all unpatched MacOS/iOS devices soon. Which would be bad...
Earlier quoted context omitted.
That is the typical defense argument I keep getting from C crowd since the mid-90's. The thing is, Σ logic errors So while errors don't go away, the exploit area is considerably dimished. Naturally it gets hand waved as errors are errors. Which is why I really do look forward for harder lawsuits when security exploits happen. When money starts speaking, more companies will take security more seriously.
Fine. I agree. Less is better. Now, I don't want to have a c vs rust like discussion, I think we will agree in fact mostly. But, all I was saying in the beginning (and I later digressed) is that just blaming 'C memory model' is not fair. (Dramatization) "Hey, boss, yes... an RCE, what a pitty. Yeah, missing check. But don't blame me. Is C it is at fault". That is just not realistic/ridiculous. Is like saying is the p…
Even Multics had less exploits than earlier UNIX versions, as stated on a DoD report about inexistence of memory corruption issues thanks to PL/I.
If you bother to read the early C history document written by Richie, they were aware of such shortcomings and thus lint was born in 1979.
A tool that to this day many devs still ignore.
As for alternative languages I haven't named a single one on this thread. There are plenty to chose from since 1961.
Earlier quoted context omitted.
Fine. I agree. Less is better. Now, I don't want to have a c vs rust like discussion, I think we will agree in fact mostly. But, all I was saying in the beginning (and I later digressed) is that just blaming 'C memory model' is not fair. (Dramatization) "Hey, boss, yes... an RCE, what a pitty. Yeah, missing check. But don't blame me. Is C it is at fault". That is just not realistic/ridiculous. Is like saying is the p…
It is fair blaming C memory model because safer systems programming languages exist since 1961, and C only got where it is thanks for Bell Labs not being able to sell UNIX for the first 10 years of its existence. Even Multics had less exploits than earlier UNIX versions, as stated on a DoD report about inexistence of memory corruption issues thanks to PL/I. If you bother to read the early C history document written b…
As for alternatives, I was just giving examples, you didn't say anything yes.
Earlier quoted context omitted.
Pretty sure it was introduced here: https://github.com/apple/darwin-xnu/commit/c10988c130af09087... In this commit a bunch of code was copy-pasted from BSD into ip_icmp.c in icmp_error() to quote IP packet data in icmp error responses. Unfortunately they forgot to copy a line from the BSD source which would prevent the overflow: icmplen = min(icmplen, M_TRAILINGSPACE(m) - sizeof(struct ip) - ICMP_MINLEN); m is alloca…
> Copy-paste programming in core networking code... There is nothing special about core networking code .
The worst part, is that you just known some sysadmins are going to use this as an excuse to block all ICMP, worsening the PMTU blackhole problem; and the "these ICMP bugs were all from the 90s" argument won't work anymore.
Is there a fix for older OSX or should I just install Linux on my 2011 iMac? Yosemite is already quite slow. OpenSuSE 13.2 was really fast on a same generation Mac Mini.
If you are behind a NAT, you won't receive ping from the Internet, so you are safe. And you can enable the firewall and "stealth mode" to make it ignore local pings. Your 2011 iMac can be update to 10.13, so I would update, a iMac 2011 with enough ram and a ssd works very well even on 10.13.