This vulnerability, hidden within the netfilter: nf_tables component, allows local attackers to escalate their privileges and potentially deploy ransomware, which could severely disrupt enterprise systems worldwide.

      • henfredemars@infosec.pub
        link
        fedilink
        English
        arrow-up
        6
        arrow-down
        1
        ·
        5 months ago

        Yes, that’s right. You cannot have a UAF situation unless you’re using unsafe “escape hatch” tools.

          • calcopiritus@lemmy.world
            link
            fedilink
            English
            arrow-up
            3
            ·
            5 months ago

            I’ve only seen it once. And it was made specifically to trigger a compiler bug. It barely looked like rust code.

            Now tell me how someone will introduce such a bug by accident. Winning the lottery 10000 times in a row with the same number isn’t impossible either. But we are engineers, not pure math pedantics. 0.000000000000001% probability for something that happens with less frequency than once per second is impossible.

      • just_another_person@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        arrow-down
        6
        ·
        5 months ago

        Improbable. Everything has bugs that surface. See my other link, or look yourself. There have been plenty of security fixes for Rust. It’s not bulletproof, just like anything else, just less likely specifically for certain memory attacks to be vectors.

        • aubeynarf@lemmynsfw.com
          link
          fedilink
          English
          arrow-up
          6
          arrow-down
          1
          ·
          5 months ago

          Your link has nothing to do with bugs in Rust. It says attackers are writing their tools in Rust, which is making the attack tools more robust.

          attackers are smart, adaptable types, and they’ve discovered a different angle: malware written in Rust often shields itself using the very design principles we admire about the language. For us, as defenders, this means a steep learning curve and a shift in focus. Let’s break this down.

          • just_another_person@lemmy.world
            link
            fedilink
            English
            arrow-up
            1
            arrow-down
            4
            ·
            5 months ago

            🤦 It’s not necessarily about bugs in Rust-lang, though you can lookup CVEs if you want. The point is that ANY software, by default, will have bugs and exploits. Doesn’t matter if it’s Rust or C. You can exploit at the core, or at implementation. It’s just matter of time and effort, as they say.

            Just flat out saying Rust, or software written in Rust is be default is secure, is a fool’s assertion. Sure it’s LESS LIKELY to have a memory exploit, but that’s where that assertion ends.

            • aubeynarf@lemmynsfw.com
              link
              fedilink
              English
              arrow-up
              1
              ·
              5 months ago

              Just flat out saying Rust, or software written in Rust is be default is secure, is a fool’s assertion.

              Who said that, Mr. Strawman?

              It’s clearly better from both language feature and security standpoint and the community is behind it. What’s the problem?

              did you mean to post a different link?

      • AMoistGrandpa@lemmy.ca
        link
        fedilink
        English
        arrow-up
        5
        ·
        5 months ago

        Rust is a programming language which was designed to be memory safe without any of the overhead caused by traditional memory safety techniques employed by existing languages (namely, garbage collection and reference counting). It does this by shifting the memory management from happening at runtime to happening at compile time. The compiler forces the programmer to follow certain rules to ensure that their program can be proven to be free of errors such as use-after-frees and double-frees. Because of this design philosophy, Rust is a good fit as a replacement for C, because it can do everything that C can while ensuring the programmer doesn’t make any mistakes with regard to memory management.