4 ms·

Yes, they used a memory corruption bug to run the payload.

by saati 3y ago

DrBazza 3y ago
And if the code submitted used Rust's 'unsafe'?
- dralley 3y ago
  Then it would be a massive shining "review me harder daddy" beacon
armitron 3y ago
You're imagining things, there is no memory corruption mechanism. The payload is delivered into the process address space by dynamic linking through a shared dependency and hijacks a function via GNU_IFUNC.
- nindalf 3y ago
  Well, Rust doesn’t support dynamic linking. So this particular attack wouldn’t be possible with Rust in March 2024. But it’s a moot point because there are undoubtedly other mechanisms a malicious maintainer could use to inject a vulnerability. Just not this exact one.
  - josephg 3y ago
    Yes, But it would at least be harder. C has so many weird quirks and edge cases - including decades of legacy mechanisms (like IFUNC) that almost nobody today understands. The underhanded C contest would be a lot less entertaining in rust. Thats a good thing. It wouldn't solve the underlying problem permanently. But I don't think there's any slam-dunk solution here. I'll take any small wins where we can get them.
    - steveklabnik 3y ago
      There was an Underhanded Rust contest many years ago https://news.ycombinator.com/item?id=15352253 https://news.ycombinator.com/item?id=15352253
  - jppittma 3y ago
    As far as I can tell, Rust _does_ support dynamic linking. You can both compile rust code to .so and link against existing shared objects. What are you talking about? >The compiler supports various methods to link crates together both statically and dynamically. This section will explore the various methods to link crates together, and more information about native libraries can be found in the FFI section of the book. https://doc.rust-lang.org/reference/linkage.html https://doc.rust-lang.org/reference/linkage.html
    - nindalf 3y ago
      > What are you talking about? I’m talking about what happens in practice, which is shipping static binaries that contain all of their dependencies, except for libc.
  - dralley 3y ago
    Rust does support dynamic linking, it's just not that useful because of the unstable ABI. You can dynamically link against C code, or Rust code presenting a C ABI, without issue, and you can dynamically link against Rust code if you accept the inherent limitations at the moment
- ReflectedImage 3y ago
  Well Valgrind originally went off on it and oss-fuzz presumably would have caught it since here's a PR from the attacker asking for it to be disabled: https://github.com/google/oss-fuzz/pull/10667 https://github.com/google/oss-fuzz/pull/10667

Yes, they used a memory corruption bug to run the payload.

by saati 3y ago

Yes, they used a memory corruption bug to run the payload.

DrBazza 3y ago

And if the code submitted used Rust's 'unsafe'?

dralley 3y ago
Then it would be a massive shining "review me harder daddy" beacon

armitron 3y ago

You're imagining things, there is no memory corruption mechanism. The payload is delivered into the process address space by dynamic linking through a shared dependency and hijacks a function via GNU_IFUNC.

nindalf 3y ago
Well, Rust doesn’t support dynamic linking. So this particular attack wouldn’t be possible with Rust in March 2024. But it’s a moot point because there are undoubtedly other mechanisms a malicious maintainer could use to inject a vulnerability. Just not this exact one.
- josephg 3y ago
  Yes, But it would at least be harder. C has so many weird quirks and edge cases - including decades of legacy mechanisms (like IFUNC) that almost nobody today understands. The underhanded C contest would be a lot less entertaining in rust. Thats a good thing. It wouldn't solve the underlying problem permanently. But I don't think there's any slam-dunk solution here. I'll take any small wins where we can get them.
  - steveklabnik 3y ago
    There was an Underhanded Rust contest many years ago https://news.ycombinator.com/item?id=15352253 https://news.ycombinator.com/item?id=15352253
- jppittma 3y ago
  As far as I can tell, Rust _does_ support dynamic linking. You can both compile rust code to .so and link against existing shared objects. What are you talking about? >The compiler supports various methods to link crates together both statically and dynamically. This section will explore the various methods to link crates together, and more information about native libraries can be found in the FFI section of the book. https://doc.rust-lang.org/reference/linkage.html https://doc.rust-lang.org/reference/linkage.html
  - nindalf 3y ago
    > What are you talking about? I’m talking about what happens in practice, which is shipping static binaries that contain all of their dependencies, except for libc.
- dralley 3y ago
  Rust does support dynamic linking, it's just not that useful because of the unstable ABI. You can dynamically link against C code, or Rust code presenting a C ABI, without issue, and you can dynamically link against Rust code if you accept the inherent limitations at the moment
ReflectedImage 3y ago
Well Valgrind originally went off on it and oss-fuzz presumably would have caught it since here's a PR from the attacker asking for it to be disabled: https://github.com/google/oss-fuzz/pull/10667 https://github.com/google/oss-fuzz/pull/10667