From BeepingComputer.
A new Linux vulnerability known as ‘Looney Tunables’ enables local attackers to gain root privileges by exploiting a buffer overflow weakness in the GNU C Library’s ld.so dynamic loader.
It’s always memory management
It’s always memory management
No wonder everyone’s crazy about Rust.
It’s certainly why it is being used to build browsers and OSs now. Those are places were memory management problems are a huge problem. It probably doesn’t make sense for every match 3 game to be made in Rust, but when errors cause massive breaches or death, it’s a lot safer than C++, taking human faulability into account.
Question would be rather: why is something like C++ needed for such simple apps?
C++ seems to be in that weird in-between place of offering high level features to be reasonable productive, but still doesn’t enforce/guarantee anything to make these features safe. I’d argue, very few programs need that. Either you’re writing business stuff, then you want safety (Java, C#, rust), or you’re writing embedded/low level stuff, then you want control (C, ASM).
The room for “productive, but not interested in safety” is basically just AAA games, I guess.
C is almost the old “steady” standard now it feels like. It’s so flexible and the frameworks are already built…
…except that we also end up with cracks in our foundations like this exploit constantly being exposed as a result of all that C
Well you’re not going to write asm if you want your code to be portable at all, and believe it or not C++ has a lot of features to help you not shoot yourself in the foot that C doesn’t have (ex. OOP, RAII, smart pointers).
C wasn’t really designed with dynamic memory management in mind. It was designed for someone who has absolute control over a machine and all the memory in it.
malloc()andfree()are just functions that some environments expose to user mode processes, but C was never designed to care where you got your memory or what you do with it.
What makes rust so resiliant against these types of atacks?
You can do dumb stuff with Rust as well.
But it’s harder and easier to spot.
You’ll never be 100% safe, but a proper lock is better than a “plz no steal” note.
Yes, it was just discovered on this year’s POPL that rust’s type system is not sound with respect to deadlock freedom.
https://dl.acm.org/doi/abs/10.1145/3571229
(of course this is not arguing that everyone should stay on C or CPP, just confirming the point that rust will allow stupid things.
Didn’t Microsoft do a study on security vulnerabilities and found that the overwhelmingly number of bugs was due to memory management?
I think you’re referring to this: https://www.zdnet.com/article/microsoft-70-percent-of-all-security-bugs-are-memory-safety-issues/
That was the what I was thinking of when I wrote the comment. The CTO of Azure also said that he deems C++ in it’s entirety to be deprecated. I felt it was an exaggeration at first but I’ve started to agree with him recently.
Google also noticed a 33% decrease in Google Home crashes caused by NullPointerExceptions after switching to Kotlin. They have also declared Kotlin to be the preferred language for android.
It seems like the industry is shifting towards “safer” languages.
I’m not in America but the organisation for NIST recommends it in guidance now and its getting backing by the nsa
https://www.zdnet.com/article/nsa-to-developers-think-about-switching-from-c-and-c-to-a-memory-safe-programming-language/ https://www.malwarebytes.com/blog/news/2022/11/nsa-guidance-on-how-to-avoid-software-memory-safety-issues
I see this becoming required in the future for new projects and solutions when working for new governnent solutions. The drum is certainly beating louder in the media about it.
See? All code sucks.
It says “sysadmins should prioritise patching”, but… has it been patched yet?
Just like…make a patch. It’s not that hard lol /j
To show you the power of Flex Tape, I sawed this library in half!
Yes, most of the major distributions have package updates with the fix. A few people have mentioned updates for Arch, Debian, and RedHat already.
Ubuntu released an update yesterday as well:
https://launchpad.net/ubuntu/+source/glibc/2.35-0ubuntu3.4
Ubuntu derivatives such as Pop!_OS should have also received this update, along with the X11 patches.
I wonder if this could be used to root previously unrootable Android based devices.
Android doesn’t use glibc, but Bionic, a C standard library developed by Google. So I don’t think this vulnerability affects Android.
What the heck. I thought, they were using musl.
Certainly seems like this has rather similar goals to musl…That’s no reason for Google not to reinvent the wheel…
They did the same with dalvik and ART now. JVMs, but more googlier!
Think Android uses Bionic instead of glibc (where the vulnerability is being exploited).
Just got some glibc updates in Arch yesterday. I wonder if they contain fixes for this.
Thanks! Not just for notifying about the fix but also showing me where package revisions are built from! I just love the transparency of Arch.
Makes me wonder. LMDE got a glibc update too and Mint is very much not leading edge when it comes to non-critical updates.
Case in point, at roughly the same time as the glibc update, we (LMDE users) were upgraded to the latest Thunderbird, 115.3.1, four or five days after that sub-version came out. That’s the sort of lag we generally see. (115.x was a bit of a surprise too as we’ve been on 102.x, but that’s not strictly relevant here.)
LMDE is 100% using Debian packages for the core OS if you want a newer Thunderbird go to flathub.
edit.
I only mentioned the lag to make the point that if we’re getting an update at the same time as Arch that maybe it was an important one.
Anyone on Mint who finds themselves trying to leap ahead of the default release schedule might want to at least sniff around a different distro or two.
That said, Flatpaks with later versions are also often available in the provided Software Manager (basically an app store), so that’s a place to look before jumping ship. Hard to tell now, but I think 115 was the Flatpak option while the, uh, default default was 102.
Ran nala after seeing this post and got a libc update on Debian myself
deleted by creator
Typically there’s a period of responsible disclosure to give the software maintainer an opportunity to fix it before it’s widely announced. After that period is up or the fix has been released the vulnerability discoverer is able to announce it and take credit for finding it.
deleted by creator
Qualys and Red Hat are pretty big names, so they’d be likely to follow the typical process.
Distro developers were notified a month ago. At least Redhat and Debian have have published fixed versions. This is common procedure.
Security through obscurity is never good.
It’s better that vulnerabilities be discussed openly. In general, people knowing the truth allows them to make better decisions.
It’s not only the good guys that find vulnerabilities. There’re many states and companies (selling to those governments) as well as regular criminal organizations paying people for vulnerabilities and exploits.
If the issue wasn’t reported, it is likely that it would have been found by someone else at some point. It might even be known already, but just not reported.
