4 ms·
> But in the main, data races have not empirically proved out as a source of exploited vulnerabilities. Say what? Data races, otherwise lumped under the bucket
by lll-o-lll 3y ago
> But in the main, data races have not empirically proved out as a source of exploited vulnerabilities.
Say what? Data races, otherwise lumped under the bucket “timing attacks”, are a common source of security exploits. A basic example is racing with code that is creating a file and applying an ACL in two steps. If I can “time” things right from a concurrent thread/process, I can get into this file before the ACL prevents me.
There are countless scenarios where multi-step operations that need to be treated atomically can be exploited by racing.
- tptacek 3y agoThat's not a vulnerability Rust prevents; it's an interaction between multiple competing runtimes. I'm not denying that race conditions (or timing attacks, another bug class Rust doesn't prevent) exist and are exploited! I'm denying that in-process data races that corrupt memory are a meaningful source of exploitable vulnerabilities. For background, I've spent most of my career doing vulnerability research. I'm by no means a world expert on memory corruption vulnerabilities (I'm still impressed that I got my imapd shellcode to work with no uppercase ASCII characters), but you can safely assume I'm not just completely blowing off huge classes of exploitable vulnerabilities because I've never heard of them. Doesn't mean I'm right! But like, if you're going "say what", you're probably misconstruing me.
- lll-o-lll 3y agoOK, but I think you are moving the goal posts. You referred to “data races” and “security exploits” and suggested the two were not related. Memory corruption is only one (small) class of security exploits. Data races cause just as many in process, in memory, exploits as multi-step file operations (we are talking breaking application security models). Perhaps Rust can prevent most of these! (I don’t know rust).
- tptacek 3y agoWhat are they? Show me the vulnerabilities you're talking about. I don't think I'm moving the goalposts here. The major distinction between Rust and (say) Java is Rust's type system formalisms to prevent in-process data race memory corruption. Those are real features, but they don't mitigate a major class of vulnerabilities.
- lll-o-lll 3y agoAny multi-step code, e.g. AddUser(); SetPermissions(); But, fair enough, this is not what you were talking about, and I reacted to something you weren’t intending to convey.
- yawaramin 3y agoIsn't it rather trivial to prevent this by creating a file with a random filename, applying the ACL, then renaming the file to the correct name?