5 ms·
Golang heap corruption during garbage collection
- friendly_chap 13y ago*Go
- rpsw 13y agoGolang is often preferred as it's much easier to search for and no need to disambiguate between other things called Go (Chinese board game, 1999 film).
- limmeau 13y agoI wish they had renamed it to Issue9 when they still had the chance.
- _ak 13y agoIssue 9 from Google Labs.
- laumars 13y agoAs well as the other similarly named programming language: Go! ( http://en.wikipedia.org/wiki/Go!_(programming_language) http://en.wikipedia.org/wiki/Go!_(programming_language) ) To be honest, I hate the name "Go" even for vocally conversing. It's such a common term that the context is completely lost with verbal communication so I'm often having to explain things in a long winded way. eg "It's programmed in Google's language named 'Go'". Google probably should have just released it as "Golang" from the start to save a lot of trouble and confusion.
- raverbashing 13y agoYes Google should have known better what's a good "googable" name. Golang is a good compromise
- ralph 13y agoBut then the debugger can't be called ogle.
- darkgray 13y agoI always thought Goo could be a name that sticks.
- mseepgood 13y ago> As well as the other similarly named programming language: Go! This language doesn't even have a home page or a download page.
- grey-area 13y agoIt'd be interesting to know whether this sort of exploit would be possible when targeting a web server as opposed to building a vulnerable go binary. Perhaps fuzzing the Golang built-in web server would be a good exercise for security researchers looking for a way to improve Go security. There's a cute and slightly scary use of go playground to demonstrate the exploit at the end of the article: http://play.golang.org/p/fOxl250j8w http://play.golang.org/p/fOxl250j8w (no longer works as play.golang was patched).
- tptacek 13y agoNo, I don't think so.
- grey-area 13y agoIf you mean no to the first bit, that's reassuring. play.golang.org is something of a special case as it tries to run code in a sandbox. I'd be more interested in exploits which attack web server processes or db drivers with malicious input as those are more likely to actually be used in the wild.
- tptacek 13y agoTo be clear: this another attack where the attacker is writing malicious Golang code and getting you to run it; ie, it's an attack that proposes Golang be situated in the same place Javascript is. Of course, in its normal configuration, Golang can simply run shell commands, read/write files, &c. It is still extremely valuable to understand how exploits like this are constructed.
- TylerE 13y agoTo also be clear: This is a bigger deal than it might be due to the way Go handles external dependencies. Github hacks might get nasty.
- tptacek 13y agoWhat? How does that make sense? External dependencies, being themselves standard Golang code, can also run shell commands, read/write files, &c.
- grey-area 13y agoMaybe referring to go packages having no metadata and being unsigned, so if a github account was hacked and you used go get on a third party pkg you could end up compiling unexpected exploit code into your binary?
- tptacek 13y agoAgain not sure what that has to do with heap corruption.
- grey-area 13y agoAh, I see what you're getting at now I think - an exploit would not be required as you are blindly running the go code anyway (e.g. in a web server it could read/write files etc just as the web server process can). Might being able to cause heap corruption let the code affect server operations in unexpected ways though? For example bypassing restrictions on an app plugin in some sort of CMS, bypassing restrictions on something like db access or passwords in memory, or bypassing a sandbox like that on play.golang.org. I don't think Go is especially vulnerable in this regard, as you noted below ruby gems are also mostly unsigned just now, however I think there was a move to have those signed after the recent problems, and Go's pkgs don't have metadata or a facility to do this AFAIK. So that could be seen as a weakness (though one shared by many other package management systems).