204
CISA Warns of Linux Kernel Use-After-Free Vulnerability Exploited in Attacks to Deploy Ransomware (cybersecuritynews.com)
submitted 1 year ago by to c/linux@lemmy.world
93 comments fedilink hide all child comments
 

This vulnerability, hidden within the netfilter: nf_tables component, allows local attackers to escalate their privileges and potentially deploy ransomware, which could severely disrupt enterprise systems worldwide.

you are viewing a single comment's thread
view the rest of the comments
[+] 11 points 1 year ago (10 children)
[deleted]
  • permalink
  • fedilink
  • source
  • parent
  • hideshow 10 child comments
    •
  • [–] -4 points 1 year ago (4 children)

    It is still possible to have security vulnerabilities in Rust

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 3 points 1 year ago

    'Use-after-free' bugs are a specific type of memory access bug that Rust was designed around preventing. It literally refers to trying to access a block of memory after it has already been freed by the memory allocator. Unless you go out of your way to use the "unsafe" keyword in rust (which in most cases, you shouldn't) then this type of bug is not possible.

  • permalink
  • fedilink
  • source
  • parent
  • [+] -9 points 1 year ago* (4 children)

    WOW. No, it would make it improbable. It's not like there can't be zero-days for Rust, bud. This particular attack vector deals with memory handling, and sure, Rust's main feature is memory security and management. Doesn't mean there aren't bugs to exploit there.

    https://linuxsecurity.com/features/rise-of-rust-based-malware

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [+] 5 points 1 year ago (2 children)
    [deleted]
  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] -2 points 1 year ago (1 child)

    🤦 It's not necessarily about bugs in Rust-lang, though you can lookup CVEs if you want. The point is that ANY software, by default, will have bugs and exploits. Doesn't matter if it's Rust or C. You can exploit at the core, or at implementation. It's just matter of time and effort, as they say.

    Just flat out saying Rust, or software written in Rust is be default is secure, is a fool's assertion. Sure it's LESS LIKELY to have a memory exploit, but that's where that assertion ends.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
    load more comments (1 reply)