4 ms·

A significant fraction of major security vulnerabilities in C/C++ codebases relate to memory-management bugs.

by MaxBarraclough 6y ago

secondcoming 6y ago
How old is the code though? It's actually really hard to get modern C++ wrong
- pjmlp 6y ago
  Assuming it gets used. https://isocpp.org/files/papers/CppDevSurvey-2021-04-summary.pdf https://isocpp.org/files/papers/CppDevSurvey-2021-04-summary...
  - MaxBarraclough 6y ago
    I'm less optimistic. Even major C++ projects that do everything right, still have issues that would have been prevented had they used a safe language. My go-to example is Chromium.
    - pjmlp 6y ago
      Agreed, I keep reaching for C++, because of the dependency many ecosystems have. Chromium is a good example actually, I bet they would rather follow the "Custom C++ libraries" and "Hardware mitigations" than the Firefox approach. https://www.chromium.org/Home/chromium-security/memory-safety https://www.chromium.org/Home/chromium-security/memory-safet... Apple did something similar recently, their iBoot firmware uses a custom safe C dialect.
      - MaxBarraclough 6y ago
        Thanks, I'd not seen that page before. > The Chromium project finds that around 70% of our serious security bugs are memory safety problems. I'll point to this next time this topic crops up.
    - v8dev123 6y ago
      Rust doesn't prevents logical bugs. Chromium had plenty of those. Most are capable of RCE. They were more dangerous than memory ones because they bypass sandbox in one-click. As for Windows, The Russians exploited a logical bug in kernel for privilege escalation. Rust also doesn't prevents overflows, DoS, UaF, OOB. For example, see CVE-2018-1000657 Another dangerous thing about Rust is Crates. Crates doesn't audit packages for malware and you will face far worse than NPM like situation in future.
      - MaxBarraclough 6y ago
        > Rust doesn't prevents logical bugs. Chromium had plenty of those. Right, but that's not the goalpost we're discussing. We're talking about languages that can guarantee safety - the absence of undefined behaviour - not languages that can fully guarantee correctness (e.g. SPARK). > Rust also doesn't prevents overflows, DoS, UaF, OOB. In Rust, integer overflow does not cause undefined behaviour. In Safe Rust, undefined behaviour cannot arise from buffer overflows, use-after-free, or out-of-bounds array access. Safe Rust precludes all undefined behaviour, after all. Unsafe Rust may be 'more safe' than C++ in degree, but not in category: it's an unsafe language, as you say. > Another dangerous thing about Rust is Crates. Again, sure.
        v8dev123 6y ago
        > integer overflow does not cause undefined behavior Source please? I ask this since Rust doesn't have a formal specification and I can't keep up with it's inner changes. It did cause undefined behavior in my case but that was 4 years ago.
        steveklabnik 6y ago
        It wasn’t undefined behavior four years ago either. RFC 560, from 2014, defines this behavior. As far as I can recall, this was mostly a codification of what was already in place; I’m pretty sure it was never UB.
        MaxBarraclough 6y ago
- MaxBarraclough 6y ago
  > It's actually really hard to get modern C++ wrong That's not true. The language is full of footguns, from its basic expressions (signed overflow, integer division-by-zero, and read-before-write are all undefined behaviour) up to concurrency (data-races are undefined behaviour) and everything in between (unsafe arrays, unsafe memory management, alignment, the list goes on). The high-level constructs in modern C++ help, but you're never further than one misstep from undefined behaviour. Even high-profile codebases by highly skilled teams using all the modern tools, still run into trouble. Even Chromium has security issues arising from the dangers of C++. The push for Rust is out of pragmatism, not trend-chasing or theoretical purity. Of course, C codebases like the Linux kernel also continue to have these issues.

A significant fraction of major security vulnerabilities in C/C++ codebases relate to memory-management bugs.

secondcoming 6y ago

How old is the code though? It's actually really hard to get modern C++ wrong

pjmlp 6y ago
Assuming it gets used. https://isocpp.org/files/papers/CppDevSurvey-2021-04-summary.pdf https://isocpp.org/files/papers/CppDevSurvey-2021-04-summary...
- MaxBarraclough 6y ago
  I'm less optimistic. Even major C++ projects that do everything right, still have issues that would have been prevented had they used a safe language. My go-to example is Chromium.
  - pjmlp 6y ago
    Agreed, I keep reaching for C++, because of the dependency many ecosystems have. Chromium is a good example actually, I bet they would rather follow the "Custom C++ libraries" and "Hardware mitigations" than the Firefox approach. https://www.chromium.org/Home/chromium-security/memory-safety https://www.chromium.org/Home/chromium-security/memory-safet... Apple did something similar recently, their iBoot firmware uses a custom safe C dialect.
    - MaxBarraclough 6y ago
      Thanks, I'd not seen that page before. > The Chromium project finds that around 70% of our serious security bugs are memory safety problems. I'll point to this next time this topic crops up.
  - v8dev123 6y ago
    Rust doesn't prevents logical bugs. Chromium had plenty of those. Most are capable of RCE. They were more dangerous than memory ones because they bypass sandbox in one-click. As for Windows, The Russians exploited a logical bug in kernel for privilege escalation. Rust also doesn't prevents overflows, DoS, UaF, OOB. For example, see CVE-2018-1000657 Another dangerous thing about Rust is Crates. Crates doesn't audit packages for malware and you will face far worse than NPM like situation in future.
    - MaxBarraclough 6y ago
      > Rust doesn't prevents logical bugs. Chromium had plenty of those. Right, but that's not the goalpost we're discussing. We're talking about languages that can guarantee safety - the absence of undefined behaviour - not languages that can fully guarantee correctness (e.g. SPARK). > Rust also doesn't prevents overflows, DoS, UaF, OOB. In Rust, integer overflow does not cause undefined behaviour. In Safe Rust, undefined behaviour cannot arise from buffer overflows, use-after-free, or out-of-bounds array access. Safe Rust precludes all undefined behaviour, after all. Unsafe Rust may be 'more safe' than C++ in degree, but not in category: it's an unsafe language, as you say. > Another dangerous thing about Rust is Crates. Again, sure.
      - v8dev123 6y ago
        > integer overflow does not cause undefined behavior Source please? I ask this since Rust doesn't have a formal specification and I can't keep up with it's inner changes. It did cause undefined behavior in my case but that was 4 years ago.
        steveklabnik 6y ago
        It wasn’t undefined behavior four years ago either. RFC 560, from 2014, defines this behavior. As far as I can recall, this was mostly a codification of what was already in place; I’m pretty sure it was never UB.
        MaxBarraclough 6y ago
MaxBarraclough 6y ago
> It's actually really hard to get modern C++ wrong That's not true. The language is full of footguns, from its basic expressions (signed overflow, integer division-by-zero, and read-before-write are all undefined behaviour) up to concurrency (data-races are undefined behaviour) and everything in between (unsafe arrays, unsafe memory management, alignment, the list goes on). The high-level constructs in modern C++ help, but you're never further than one misstep from undefined behaviour. Even high-profile codebases by highly skilled teams using all the modern tools, still run into trouble. Even Chromium has security issues arising from the dangers of C++. The push for Rust is out of pragmatism, not trend-chasing or theoretical purity. Of course, C codebases like the Linux kernel also continue to have these issues.