4 ms·

How many security-critical bugs have been found in libc in the last ten years? I know that in principle Rust is safer, but I am wondering it makes sense to re-

by zakk 9y ago

How many security-critical bugs have been found in libc in the last ten years? I know that in principle Rust is safer, but I am wondering it makes sense to re-implement code so heavily audited as libc. Wouldn’t it be better to redirect the effort to some other less audited code?

rwmj 9y ago
Lots: https://www.cvedetails.com/vulnerability-list/vendor_id-72/product_id-767/GNU-Glibc.html https://www.cvedetails.com/vulnerability-list/vendor_id-72/p...
- sebcat 9y ago
  musl: https://www.cvedetails.com/vulnerability-list/vendor_id-16859/Musl-libc.html https://www.cvedetails.com/vulnerability-list/vendor_id-1685... Can't find separate listings for libc in FreeBSD, OpenBSD but the list is smaller than glibc if you check e.g., VuXML or https://www.cvedetails.com/vulnerability-list/vendor_id-97/product_id-163/Openbsd-Openbsd.html https://www.cvedetails.com/vulnerability-list/vendor_id-97/p... Looks like glibc is the worst sinner here.
  - rwmj 9y ago
    More people study and use glibc, so I guess they find more bugs. On the other hand glibc has a larger code base. Anyway it's difficult to compare bug counts across projects.
- zuzun 9y ago
  Half of them are logic errors and around 15 bugs are integer overflows of which the project above is riddled with.
- archi42 9y ago
  No no, these are not bugs, you are just misinterpreting the {standard, API, intention, stars} ;-) /sarcasm
  - archi42 9y ago
    Hm, at those who downvoted me: Read some older glibc bug reports. For example the one about sscanf("foo", "%10s", strptr) returning 1. Hint: According to the standard, it should return 0. Musl does it right, which recently broke some of my test cases. But the bug is known and not fixed since years, maybe a decade...
dralley 9y ago
While better security is a goal of relibc it is not actually one of the primary goals. Most existing libc implementations are not particularly portable across different kernels, and especially not to microkernels such as Redox OS. The goal is to have a standard library that is easier for the Redox OS devs to develop in (obviously, Rust makes sense here), and not so tied down to one kernel like musl is for example.
- shmerl 9y ago
  Will Rust be able to switch to it completely as to cut out relying on glibc on Linux for example?
  - jackpot51 9y ago
    Yes, that would be possible.
  - thristian 9y ago
    There are important reasons why Rust should continue to use glibc by default, but the Rust compiler already supports musl libc on Linux, so glibc is not required.
    - shmerl 9y ago
      > here are important reasons why Rust should continue to use glibc by default To be more compatible with system code?
      - comex 9y ago
        That’s one reason. Another is NSS: http://www.gnu.org/software/libc/manual/html_node/Name-Service-Switch.html http://www.gnu.org/software/libc/manual/html_node/Name-Servi... It’s a mechanism in glibc for loading dynamic libraries at runtime (based on a config file) to handle DNS and some other things. Anything statically linked can’t support this, which can cause issues with some setups.
CJefferson 9y ago
A friend of mine found a bug in memmove over Christmas. Rust would have caught it (signed/unsigned issue), but the bug was in sse2 assembler so would still exist if they allowed optimised ask in the rust version.
- dikaiosune 9y ago
  The path to stabilizing explicit simd intrinsics for rust should make many of those kinds of errors easier to catch with rusts casting requirements.
Thaxll 9y ago
Like Redox this lib will be probably be never be seriously used. It's a pet project.
- nh2 9y ago
  How do you know that? Look how much Redox has achieved in so little time and with so few people. It has everything from a kernel to a fully working desktop GUI. All because they use a good language that allows easy code reuse and proper library packaging. Also remember that Linux at some point was somebody's pet project.
- pjmlp 9y ago
  "Hello everybody out there using minix – I’m doing a (free) operating system (just a hobby, won’t be big and professional like gnu) for 386(486) AT clones. This has been brewing since april, and is starting to get ready. I’d like any feedback on things people like/dislike in minix, as my OS resembles it somewhat (same physical layout of the file-system (due to practical reasons) among other things). I’ve currently ported bash(1.08) and gcc(1.40), and things seem to work. This implies that I’ll get something practical within a few months, and I’d like to know what features most people would want. Any suggestions are welcome, but I won’t promise I’ll implement them :)" -- Linus
  - jhasse 9y ago
    survivorship bias
    - carlmr 9y ago
      It is, but everything starts at humble beginnings.

by zakk 9y ago

rwmj 9y ago

Lots: https://www.cvedetails.com/vulnerability-list/vendor_id-72/product_id-767/GNU-Glibc.html https://www.cvedetails.com/vulnerability-list/vendor_id-72/p...

sebcat 9y ago
musl: https://www.cvedetails.com/vulnerability-list/vendor_id-16859/Musl-libc.html https://www.cvedetails.com/vulnerability-list/vendor_id-1685... Can't find separate listings for libc in FreeBSD, OpenBSD but the list is smaller than glibc if you check e.g., VuXML or https://www.cvedetails.com/vulnerability-list/vendor_id-97/product_id-163/Openbsd-Openbsd.html https://www.cvedetails.com/vulnerability-list/vendor_id-97/p... Looks like glibc is the worst sinner here.
- rwmj 9y ago
  More people study and use glibc, so I guess they find more bugs. On the other hand glibc has a larger code base. Anyway it's difficult to compare bug counts across projects.
zuzun 9y ago
Half of them are logic errors and around 15 bugs are integer overflows of which the project above is riddled with.
archi42 9y ago
No no, these are not bugs, you are just misinterpreting the {standard, API, intention, stars} ;-) /sarcasm
- archi42 9y ago
  Hm, at those who downvoted me: Read some older glibc bug reports. For example the one about sscanf("foo", "%10s", strptr) returning 1. Hint: According to the standard, it should return 0. Musl does it right, which recently broke some of my test cases. But the bug is known and not fixed since years, maybe a decade...

dralley 9y ago

While better security is a goal of relibc it is not actually one of the primary goals. Most existing libc implementations are not particularly portable across different kernels, and especially not to microkernels such as Redox OS. The goal is to have a standard library that is easier for the Redox OS devs to develop in (obviously, Rust makes sense here), and not so tied down to one kernel like musl is for example.

shmerl 9y ago
Will Rust be able to switch to it completely as to cut out relying on glibc on Linux for example?
- jackpot51 9y ago
  Yes, that would be possible.
- thristian 9y ago
  There are important reasons why Rust should continue to use glibc by default, but the Rust compiler already supports musl libc on Linux, so glibc is not required.
  - shmerl 9y ago
    > here are important reasons why Rust should continue to use glibc by default To be more compatible with system code?
    - comex 9y ago
      That’s one reason. Another is NSS: http://www.gnu.org/software/libc/manual/html_node/Name-Service-Switch.html http://www.gnu.org/software/libc/manual/html_node/Name-Servi... It’s a mechanism in glibc for loading dynamic libraries at runtime (based on a config file) to handle DNS and some other things. Anything statically linked can’t support this, which can cause issues with some setups.

CJefferson 9y ago

A friend of mine found a bug in memmove over Christmas. Rust would have caught it (signed/unsigned issue), but the bug was in sse2 assembler so would still exist if they allowed optimised ask in the rust version.

dikaiosune 9y ago
The path to stabilizing explicit simd intrinsics for rust should make many of those kinds of errors easier to catch with rusts casting requirements.

Thaxll 9y ago

Like Redox this lib will be probably be never be seriously used. It's a pet project.

nh2 9y ago
How do you know that? Look how much Redox has achieved in so little time and with so few people. It has everything from a kernel to a fully working desktop GUI. All because they use a good language that allows easy code reuse and proper library packaging. Also remember that Linux at some point was somebody's pet project.
pjmlp 9y ago
"Hello everybody out there using minix – I’m doing a (free) operating system (just a hobby, won’t be big and professional like gnu) for 386(486) AT clones. This has been brewing since april, and is starting to get ready. I’d like any feedback on things people like/dislike in minix, as my OS resembles it somewhat (same physical layout of the file-system (due to practical reasons) among other things). I’ve currently ported bash(1.08) and gcc(1.40), and things seem to work. This implies that I’ll get something practical within a few months, and I’d like to know what features most people would want. Any suggestions are welcome, but I won’t promise I’ll implement them :)" -- Linus
- jhasse 9y ago
  survivorship bias
  - carlmr 9y ago
    It is, but everything starts at humble beginnings.