The bug is integer overflow in a random C data-processing library (specifically regexes) leading to RCE.

Who else is tired of C libraries since this week?

Gigachad 4 hours ago | parent | next [-]

I've been calling this out for forever now and have been repeatedly told that actually, competent devs with C are fine and the C software we use has been battle tested so it's largely secure.

And now we are seeing that was all untrue.

▲

cristoperb 4 hours ago | parent | next [-]

now it's even more battle tested!

▲

awesome_dude 2 hours ago | parent | prev [-]

Let's rewrite everything - said every 15 minutes by every new developer with a new toy.

How about being constructive instead - old bug in old code is no surprise, no matter the language/technology.

	▲	Gigachad 2 hours ago \| parent \| next [-]
		This was hardly a convincing argument before the current CVE explosion. By now C needs to be dead and buried for network accessible code.
	▲	fartfeatures 2 hours ago \| parent \| prev [-]
		Someone needs to tell DARPA: https://www.darpa.mil/research/programs/translating-all-c-to...

▲

grg0 3 hours ago | parent | prev | next [-]

And how does Rust help? As far as I know, an integer overflow in Rust panics in debug but just wraps in release (a bad choice in my opinion). Would it help specifically in the code execution part of the exploit?

	▲	jooops1 3 hours ago \| parent \| next [-]
		The key difference is even If an Integer overflows in Rust It still doesn't violate memory safety in safe Rust and therefore doesn't lead to exploitation.
	▲	Fordec 38 minutes ago \| parent \| prev [-]
		[profile.release] overflow-checks = true

▲

ferrisjoke 3 hours ago | parent | prev [-]

I've heard the joke many times, but I didn't expect that even programming would ever end up wanting to evolve to crabs.