7 ms·
> Image parsers in UEFIs from all three major IBVs are riddled with roughly a dozen critical vulnerabilities that have gone unnoticed until now. If your code h
by neilv 3y ago
> Image parsers in UEFIs from all three major IBVs are riddled with roughly a dozen critical vulnerabilities that have gone unnoticed until now.
If your code has a dozen vulnerabilities, it has more than that.
Also, every time I see a 2D image library, I assume it almost certainly has vulnerabilities. There's something magical about the task of coding 2D image libraries, such that it really calls out how bad we are at writing correct code (especially in C).
- hulitu 3y ago> (especially in C). I thought iMessage was written in ObjectiveC. /s
- Guvante 3y agoAs easy as it seems to be to just include an image decoder it feels like "must be a specific size bmp file" is a perfectly acceptable solution here.
- DaiPlusPlus 3y ago...but what if the "must be a specific sized BMP file" rule is because if you were to flash the eprom with, say, a PNG file it meant you suddenly got root over Intel's Management Engine in your CPU?
- hsbauauvhabzb 3y agoParent is suggesting logic which refuses to parse png standard, not extension/mime-type validation. Presumably a precision formatted png uploaded as a bmp will just render as a starry mess of color, assuming format confusion is possible within the bmp standard.
- Guvante 3y agoBMP isn't encoded at all. Effectively width + height followed by row ordered pixels. Hard code file length and fail if the width or height are different. Copying pixels to the screen is hard to mess up.
- robinsonb5 3y ago20 years ago that was, in fact, the solution. (I wrote some tools back then to convert between 256-colour TIFF and the "AWBM" format needed by the BIOS on VIA's EPIA motherboards.)
- Guvante 3y agoI dunno, I think "solution" implies thought was put into this risk factor. Assuming a security risk in writing to data read by the BIOS would be crazy 20 years ago. If you could update the image you already were inside the airlock.
- yjftsjthsd-h 3y agoThis is one of the reasons I'm a big fan of wuffs[0] - it specifically targets dealing with formats like pictures, safely, and the result drops in to a C codebase to make the compat/migration story easy. [0] https://github.com/google/wuffs https://github.com/google/wuffs
- pgeorgi 3y agoSee also https://review.coreboot.org/c/coreboot/+/78271 https://review.coreboot.org/c/coreboot/+/78271 :-)
- yjftsjthsd-h 3y agoOh, very nice:) Great to see that!
- exikyut 3y ago> This commit also adapts our jpeg fuzz test to work with the modified > API. After limiting it to deal only with approximately screen sized > inputs, it fuzzed for 25 hours CPU time without a single hang or > crash. This is a notable improvement over running the test with our > old decoder which crashes within a minute. Cooool.
- flashback2199 3y ago> 2D image library Maybe I'm ignorant but what's a 1D image ?
- Wingy 3y agoA line of pixels.
- flashback2199 3y agoAh ok. It sounds like it's important to distinguish the two by saying 2D image, but I'm sure the reason is too advanced for me.
- yjftsjthsd-h 3y agoMore likely to be distinguishing 2D from 3D graphics, and just saying "image" can be ambiguous when firmware images are in play.
- DaiPlusPlus 3y agoSo, are video-files of 2D images technically 3D then? and time-based volumetric recording of 3D video-games are 4D?
- picture 3y agoTime doesn't necessarily have to be another dimension. They're just what they are but organized in time.
- maxbond 3y agoYou don't have to think of it as a dimension if that obfuscates the problem or isn't a useful mental model for you, but "organizing" it is what a dimension does. You can think of an image as colors or intensities "organized by" (I would call it "indexed by") width and height. If you work with videos in machine learning, you generally accept a 6 dimensional tensor (width, height, time, red, green, blue - your order may vary, time often comes first. And you may use grayscale instead of color to reduce the number of dimensions.).
- Nexxxeh 3y agoAlso, no-one knows if it has gone unnoticed until now. Only that it's not been publicly called out until now. It could actively have been exploited for years, but those who discovered it kept their secret. I wonder if it'll show up as previously discovered in the next big nation state leak from NSA/GCHQ/Unit 8200/whoever.
- TacticalCoder 3y ago> Also, no-one knows if it has gone unnoticed until now. Or undetected. They may not be exploits but backdoors.
- crotchfire 3y agobackdoor, bugdoor, tomatoe, tomatoh
- cqqxo4zV46cp 3y agoIt doesn’t help that the C development community is still largely in denial about the very human cognitive limitations that result in unsafe code being written time and time again.
- Vilian 3y agowhy do you think that?, in my perception was the opposite
- insanitybit 3y agoGo read one of the more C/C++ focused subreddits. HN is skewed towards specific groups. Read r/cpp and you will see a ton of people saying "I can write perfectly memory safe C++", I see it often (because I love C++ and enjoy reading about it).
- lionkor 3y agoIm always hoping that it's the bad subset of the lang users that are loud, but for this one youre most probably right. I've been using C++ for a while and its definitely the language I know best, but I have to ackmowledge that its impossible to write really truly safe code in it. Rust makes it easier, but a panic() is just a segfault with a crash log to the user -- they dont care that its safe, it just died.
- saagarjha 3y agoThey do care about when it is unsafe, at least to some extent.
- dullcrisp 3y agoThe problem with a segfault isn’t that it crashed. The problem is that it might just as easily not have crashed but silently corrupted memory instead. A crash is (generally) safe.
- insanitybit 3y ago
- chriswarbo 3y ago> Also, every time I see a 2D image library, I assume it almost certainly has vulnerabilities. There's something magical about the task of coding 2D image libraries, such that it really calls out how bad we are at writing correct code (especially in C). If image libraries are magical, then font rendering libraries are a transcendental nexus of cosmic power...
- raphlinus 3y agoWhich largely explains the fontations project. This is new Rust implementation of the lower levels of the font stack, and also on track to shipping, it's now in Chrome Canary. https://github.com/googlefonts/fontations https://github.com/googlefonts/fontations