3 ms·

> I think you do not really know what you are talking about here. Yeah, maybe. The reference says > The behavior is undefined if the calls to functions in th

> I think you do not really know what you are talking about here. Yeah, maybe. The reference says > The behavior is undefined if the calls to functions in this library introduce a file system race, that is, when multiple threads, processes, or computers interleave access and modification to the same object in a file system. My understanding of the vulnerability happens because a different process interleaves access to the same object in the file system between the time of check (TOC) and time of use (TOU) leading to the TOCTOU bug. And this isn't a vulnerability in C++ because it's considered UB by the spec. I'd be really interested in hearing you explain why this section of the spec isn't relevant to the TOCTOU bug. I'd learn something new if that's the case. I know you're frustrated by the discussion of CVEs but please understand that the entire article and this thread is based on understanding C and C++'s security record based on CVEs. Herb Sutter compared C++ with Rust, pointing out 61 CVEs in C++ and 6 in Rust. Therefore it's really relevant to compare the attitudes of both communities about filing those CVEs. The fact that the exact same vulnerability warranted a Rust CVE but not a C++ CVE is quite telling. I'm not happy with the CVE system, no one is. You're not either. All I'm saying is, comparisons of CVEs across languages, like Sutter has done, aren't helpful or useful. He claims that C++ will be equally safe as Rust if CVEs were reduced by 90%. But as long as the C++ community doesn't file CVEs when Rust does, that's not correct. And it's likely to be more incorrect if the community follows through with Herb's suggestion to take control of the CVE filing mechanism.

adev_ 3y ago
> My understanding of the vulnerability happens because a different process interleaves access to the same object in the file system between the time of check (TOC) and time of use (TOU) leading to the TOCTOU bug. And this isn't a vulnerability in C++ because it's considered UB by the spec. The definition as Undefined Behaviour in the spec is quite unfortunate and a mistake. We do agree on that. > I'm not happy with the CVE system, no one is. You're not either. All I'm saying is, comparisons of CVEs across languages, like Sutter has done, aren't helpful or useful. On this I do agree too. And saying that a lot of communities have things to learn from the Rust core team about security issue handling is a completely fair statement. What infuriated me was your point: > but only because C++ doesn't regard the issue as a problem at all. The problem definitely exists in C++, but it's not acknowledged as a problem, let alone fixed Which tend to under-mean that the C++ community took no action regarding to this exact problem. When, in fact, it is already patched and released in all major implementations (exactly like Rust did).
- nindalf 3y ago
  Yeah you're right, I originally said no action was taken because I was going off of my recollection of the original issue 2 years ago. When Rust released this blog post (Jan 20th 2022) the same issue had been fixed already in Python. When I asked around about C++, people pasted the reference link and said it didn't need to be fixed because it was defined as UB. I stand corrected, they did fix it. And good on them for fixing it and not closing it as "spec says its fine". It's still bad they didn't file a CVE for it, knowing that other languages did so. It reduces trust in their ecosystem.
  - adev_ 3y ago
    > It's still bad they didn't file a CVE for it, knowing that other languages did so. It reduces trust in their ecosystem. Curiosity question: Do you know if python has also a CVE for this exact same problem ? I am not able to find it back through their git history.
    - lifthrasiir 3y ago
      In my understanding, no. I believe it was bpo-4489 [1], and I couldn't find a matching advisory from the PSF's database [2] which should contain most historical advisories as well (it does seem to miss earliest advisories like PSF-2005-001 and PSF-2006-001 though). [1] https://github.com/python/cpython/issues/48739 https://github.com/python/cpython/issues/48739 [2] https://github.com/psf/advisory-database/ https://github.com/psf/advisory-database/

adev_ 3y ago

> My understanding of the vulnerability happens because a different process interleaves access to the same object in the file system between the time of check (TOC) and time of use (TOU) leading to the TOCTOU bug. And this isn't a vulnerability in C++ because it's considered UB by the spec. The definition as Undefined Behaviour in the spec is quite unfortunate and a mistake. We do agree on that. > I'm not happy with the CVE system, no one is. You're not either. All I'm saying is, comparisons of CVEs across languages, like Sutter has done, aren't helpful or useful. On this I do agree too. And saying that a lot of communities have things to learn from the Rust core team about security issue handling is a completely fair statement. What infuriated me was your point: > but only because C++ doesn't regard the issue as a problem at all. The problem definitely exists in C++, but it's not acknowledged as a problem, let alone fixed Which tend to under-mean that the C++ community took no action regarding to this exact problem. When, in fact, it is already patched and released in all major implementations (exactly like Rust did).

nindalf 3y ago
Yeah you're right, I originally said no action was taken because I was going off of my recollection of the original issue 2 years ago. When Rust released this blog post (Jan 20th 2022) the same issue had been fixed already in Python. When I asked around about C++, people pasted the reference link and said it didn't need to be fixed because it was defined as UB. I stand corrected, they did fix it. And good on them for fixing it and not closing it as "spec says its fine". It's still bad they didn't file a CVE for it, knowing that other languages did so. It reduces trust in their ecosystem.
- adev_ 3y ago
  > It's still bad they didn't file a CVE for it, knowing that other languages did so. It reduces trust in their ecosystem. Curiosity question: Do you know if python has also a CVE for this exact same problem ? I am not able to find it back through their git history.
  - lifthrasiir 3y ago
    In my understanding, no. I believe it was bpo-4489 [1], and I couldn't find a matching advisory from the PSF's database [2] which should contain most historical advisories as well (it does seem to miss earliest advisories like PSF-2005-001 and PSF-2006-001 though). [1] https://github.com/python/cpython/issues/48739 https://github.com/python/cpython/issues/48739 [2] https://github.com/psf/advisory-database/ https://github.com/psf/advisory-database/