4 ms·

From GP's link: > While the crashing bug was reported to the VirtualBox tracker (https://www.virtualbox.org/ticket/16444 https://www.virtualbox.org/ticket/1644

From GP's link: > While the crashing bug was reported to the VirtualBox tracker (https://www.virtualbox.org/ticket/16444 https://www.virtualbox.org/ticket/16444), it was never considered a security vulnerability, and is not marked as one. This ticket is 15 months old at the time of writing this post and still marked as unresolved. They might not be The Worst, but at 15 months, they're not great.

ikeboy 8y ago
The text of the bug doesn't have any suggestion of it being a vulnerability and as the closing comment indicates, not enough information to reproduce
- newaccoutnas 8y ago
  Agreed, as far as bug reports got that's pretty lousy.
- zaroth 8y ago
  “Unreproducible” can also be read as “Wasn’t worth the effort to reproduce”. Very, very rarely will a Sev1 crash in production software be instantly reproducible. When it is, it’s an utter embarrassment. More often the full set of conditions which lead to the crash are unknown, rare, and hard to fully quantify all at once. And yet, we know with certainty that the crash did happen and by definition it is a valid bug in any sane world where “don’t crash” is an absolute requirement. Any crashing bug in a hypervisor must be assumed to be security critical until proven otherwise. Even after “proving” a crash can’t possibly be exploited, you should still assume that a clever attacker will figure out a way. The Venn diagram of “crashing bugs” and “security exploits” is vanishingly disjoint.
  - ikeboy 8y ago
    "don't crash" can't be an absolute requirement, because operating systems. I've had programs crash when running out of RAM, I think sometimes there's no way for the OS to recover without killing some programs. If you absolutely can't crash, you need to build an OS that caters to that - modern OSes explicitly prioritize other goals, like performance
    - FartyMcFarter 8y ago
      The usual definition of "crash" does not include "getting killed by the OS while behaving normally".
      - ikeboy 8y ago
        If you're in a scenario where a crash can mean a critical security vulnerability, then being killed by the OS can also be, because some parts might continue running with an unexpected state

ikeboy 8y ago

The text of the bug doesn't have any suggestion of it being a vulnerability and as the closing comment indicates, not enough information to reproduce

newaccoutnas 8y ago
Agreed, as far as bug reports got that's pretty lousy.
zaroth 8y ago
“Unreproducible” can also be read as “Wasn’t worth the effort to reproduce”. Very, very rarely will a Sev1 crash in production software be instantly reproducible. When it is, it’s an utter embarrassment. More often the full set of conditions which lead to the crash are unknown, rare, and hard to fully quantify all at once. And yet, we know with certainty that the crash did happen and by definition it is a valid bug in any sane world where “don’t crash” is an absolute requirement. Any crashing bug in a hypervisor must be assumed to be security critical until proven otherwise. Even after “proving” a crash can’t possibly be exploited, you should still assume that a clever attacker will figure out a way. The Venn diagram of “crashing bugs” and “security exploits” is vanishingly disjoint.
- ikeboy 8y ago
  "don't crash" can't be an absolute requirement, because operating systems. I've had programs crash when running out of RAM, I think sometimes there's no way for the OS to recover without killing some programs. If you absolutely can't crash, you need to build an OS that caters to that - modern OSes explicitly prioritize other goals, like performance
  - FartyMcFarter 8y ago
    The usual definition of "crash" does not include "getting killed by the OS while behaving normally".
    - ikeboy 8y ago
      If you're in a scenario where a crash can mean a critical security vulnerability, then being killed by the OS can also be, because some parts might continue running with an unexpected state