12 ms·
QEMU: out-of-bounds memory access issue
- ianopolous 10y agoWe need emulators written in safe languages.
- jryan49 10y agoI guess you're the first to volunteer then! :D
- mhurron 10y agoNo, no no, when someone says that, they're telling other people to do that work.
- ianopolous 10y agoOr in this case, not. https://github.com/ianopolous/JPC https://github.com/ianopolous/JPC
- frou_dh 10y agoWell done. That was "Did you win the Putnam"-esque
- nickpsecurity 10y agoI thought it had to be a safe language rather than a 0-day hoarding platform. :P Least you did your part getting us a start on it. It could be ported to a simpler, safer language and runtime.
- ianopolous 10y agoI'll bite. :-) Java is a perfectly safe language, with one of the best defined specs out there. The JVM, however, has had it's share of vulnerabilities, but that comes with the territory of being installed on 3 billion devices.
- nickpsecurity 10y agoI'll be nice since you are. Java is well-defined language with safety features. Problem was it's written for inefficient abstract machine hard to implement correctly and with much complexity. That and its libraries are written in an unsafe language. Whereas, languages like Modula-3, Ada, or safe variants of C are straight-forward to map to real hardware with small to no runtimes and libraries in same language. Many checks in by default. Two, C subsets and SPARK, can be proven free of common errors. There's a vast difference in safety between such languages and the Java platform. Complexity of compiler/runtime and unsafe libraries are main reasons. Safety-critical, minimal runtimes exist for Java but they're slow and I doubt you paid $$$ for them. ;)
- ianopolous 10y agoWhat's your opinion of the Graal substrate VM? It is 98% implemented in Java, allows you to precompile a VM exactly for your language, and allows you to exclude the entire Java core libraries, for a super lean, but still highly optimized and safe runtime.
- nickpsecurity 10y agoI look at it tonight when I'm off. Already sounds better than regular platform.
- nickpsecurity 10y agoDamn, had I had this link... http://lafo.ssw.uni-linz.ac.at/papers/2015_CGO_Graal.pdf http://lafo.ssw.uni-linz.ac.at/papers/2015_CGO_Graal.pdf ...I could've replied immediately. Graal keeps HotSpot VM, presumably libraries too, while replacing the JIT with an extra-aggressive one (semantic risk) coded in Java (lower code-risk). It's still bad as it barely addresses platform's overall risk. Might make a better, safer JIT for existing platform. The [potentially] better ones are those designed for high-reliability applications such as Aonix's PERC and JamaicaVM. They tend to try to do less with more predictability. There was one implemented on Oberon called Jaos JVM. Also, although JVM itself is orthogonal to this, you can run your Java program on JX Operating System for higher security. http://www4.cs.fau.de/Projects/JX/ http://www4.cs.fau.de/Projects/JX/
- hacknat 10y agoThat has to feel pretty good. This reminds me of the cpercival exchange way back when. It's funny to see people set themselves up like that in this community. Hello! A good chunk of the users of this site build stuff for a living and for fun!
- cperciva 10y agoThis reminds me of the cpercival exchange way back when. It's funny to see people set themselves up like that in this community. Just to be clear, I didn't set that up. In fact I was rather amazed at that question arriving in my lap.
- pm215 10y agoI'd love QEMU to move to some safer language. Unfortunately I don't know any which meet the necessary criteria: - support linux, osx, windows - mature enough for widespread support in distros - support at least half a dozen different host cpu architectures - simply interoperable at a C ABI level so you can move parts of the system to the new language without doing a 100% rewrite (There are probably other requirements too but that last one is the biggie really.)
- pjmlp 10y agoAda, FreePascal, ...?
- ludamad 10y agoProblem is that when you use C you get the low level coders on board relatively easily. Not always the case in other languages
- pjmlp 10y agoWhen I started programming, C was just yet another systems programming language. Low level coders were using straight Assembly. I find ironic to see such statements about 40 years later.
- nickpsecurity 10y agoThen Cyclone or any of safe C subsets/variants.
- nickpsecurity 10y agoThere's work on it in the verification community but not quite a full emulator yet. Is work on various pieces though. Meanwhile, separation kernels like seL4 and verified hypervisors like NOVA/Seoul can reduce risks.
- bluedino 10y agoWhat would the performance penalty be?
- wyldfire 10y ago> The sVirt and Seccomp functionalities used to restrict host's QEMU process privileges and resource access might mitigate the impact of successful exploitation of this issue. seccomp is pretty awesome IMO. Would that more software opted in to dropping unneeded system access.
- groovy2shoes 10y agoSounds similar to OpenBSD's `pledge`, a system call that a process can use to tell the system which minimum privileges it needs, so that a buffer overflow exploit has less of a chance of running amok (depending on the program). It's new in 5.9 and most of the base system and a bunch of ports (including Chromium) have been updated to make use of it. Of course, it doesn't completely prevent someone from doing something nasty, but it does force them to be much more targeted in which programs they can attack. Every little thing helps a little bit, and it all adds up.
- cyphar 10y agoMy issue with pledge is that it doesn't get applied to the new process on exec. This makes it essentially useless for a program that needs to start any other programs to do it's job. Seccomp is quite cool because it lets you filter syscalls and then there's no way for you to disable the filtering (assuming no bugs in the implementation).
- IcePic 10y agoThen again, any program that in any way starts another binary (or several) would always end up having to pledge the sum of all possible child permissions, so it would just mean that any such program (like sudo) would just not be limited at all just so it can run both ls and reboot, when the setuid sudo program would be just the kind of program you would like to have pledged so that it doesn't talk net when it shouldn't or does other out of line weirdness.
- cyphar 10y ago
- zymhan 10y agoSo there isn't a patch for this yet it seems?