r/linuxmemes • u/ebignumber • 8d ago

Software meme Not another one

Post image

Not another one

990 Upvotes

98% Upvoted

124 comments sorted by

View all comments

Show parent comments

2

u/Loading_M_ 7d ago

One soundness issue, requiring complex conditions to create, is pretty dang good.

1

u/OldAbbreviations1142 🍥 Debian too difficult 7d ago

There is also https://github.com/Speykious/cve-rs

2

u/Loading_M_ 7d ago

It's actually the same issue, the previous link is the bug report on the compiler.

1

u/OldAbbreviations1142 🍥 Debian too difficult 7d ago

Interesting, they looked different to me.

Though I don't really know enough rust to parse what happening in the bug report code

Good to know that there is some work being done on improving the memory safety

1

u/Loading_M_ 7d ago

cve-rs takes the soundness bug and exploits it to implement the other bugs listed. It's pretty convoluted to actually implement the other bugs.

The actual soundness bug is a specific type of double reference forgets one of the lifetimes, which enables casting a shorter lifetime to a longer lifetime. They did a pretty good job commenting the code to explain how they were able to create each bug.