CVE-2021-32471 – Input validation in Marvin Minsky 1967 Turing Machine

> NOTE: the discoverer states "this vulnerability has no real-world implications."

Not sure if declaring this is standard practice, but I had a good laugh.

A better link is the research paper:

https://arxiv.org/abs/2105.02124

> The universal Turing machine is generally considered to be the simplest, most abstract model of a computer. This paper reports on the discovery of an accidental arbitrary code execution vulnerability in Marvin Minsky's 1967 implementation of the universal Turing machine. By submitting crafted data, the machine may be coerced into executing user-provided code. The article presents the discovered vulnerability in detail and discusses its potential implications. To the best of our knowledge, an arbitrary code execution vulnerability has not previously been reported for such a simple system.

> A common strategy for understanding a problem is to reduce it to its minimal form. In the field of computer security,we may ask the question: "What is the simplest system exploitable to arbitrary code execution?" In this article, we pro-pose an answer to that question by reporting on the discovery that a well-established implementation of the universal Turing machine is vulnerable to a both unintentional and non-trivial form of arbitrary code execution.

Issues like this, in obsolete code, are a lot of fun. Even if they are essentially meaningless.

I reported CVE-2014-3423 back in the day, relating to GNU Emacs using a predictable filename when talking to the Mosiac browser. No choice, as that was what the browser required, something that wouldn't exist these days.

Sure this CVE sounds like a joke but if you create a programming language that is non Turing complete it is much easier to secure than a Turing complete language.

Making a language that have the expressive power of finite state machines could be an example.

Yes, that's the joke.