▲ 182 ▼ Linux Kernel Rust Code Sees Its First CVE Vulnerability (www.phoronix.com) submitted 10 months ago by hal_5700X@sh.itjust.works to c/technology@lemmy.world 46 comments fedilink hide all child comments
[–] ryannathans@aussie.zone 18 points 10 months ago (9 children) For memory safety, which is not unsafe rust permalink fedilink source parent hideshow 9 child comments replies: [–] hal_5700X@sh.itjust.works [S] 9 points 10 months ago (8 children) You say that. But the CVE is a memory corruption bug. permalink fedilink source parent hideshow 8 child comments replies: [–] dgriffith@aussie.zone 48 points 10 months ago (1 child) Which is worse? Entire driver written in a non memory safe language? The interface to the rest of the kernel is marked as unsafe and then the other X percent is safe from memory corruption? Surely if X > 0 then this is still a net improvement? permalink fedilink source parent hideshow 1 child comment replies: [–] sik0fewl@lemmy.ca 6 points 10 months ago I don't know, but I found this article interesting with respect to unsafe Rust - https://lightpanda.io/blog/posts/why-we-built-lightpanda-in-zig permalink fedilink source parent [–] JustAnotherKay@lemmy.world 9 points 10 months ago They’re not calling Rust unsafe. There is a memory safe mode and a memory unsafe mode in Rust, and this was built in unsafe Rust which allowed for the memory bug to be exploited permalink fedilink source parent [–] ryannathans@aussie.zone 2 points 10 months ago (4 children) You don't understand what unsafe means permalink fedilink source parent hideshow 4 child comments replies: [–] sem@piefed.blahaj.zone 8 points 10 months ago* (last edited 10 months ago) (3 children) Rust by default will not allow you to make certain kinds of errora, which is great. But if you are doing something advanced, down at the hardware level [see below], you might need to disable those defaults in order to write the code you need. This is what people mean by "unsafe" -- lacking the normal memory safeguards. With careful coding, "unsafe rust" or normal C, for that matter, can be free of bugs and safe. But if programmers make a mistake, vulnerabilities can creep in more easily in the unsafe sections. Is that basically it? permalink fedilink source parent hideshow 3 child comments replies: [–] CandleTiger@programming.dev 7 points 10 months ago (2 children) But if you are doing something advanced, down at the hardware level This part is wrong. Otherwise yes correct. The “unsafe” code in rust is allowed to access memory locations in ways that skip the compiler’s check and guarantee that that memory location has valid data. They programmer is on their own to ensure that. Which as you say is just the normal state of affairs for all C code. This is needed not because of hardware access but just because sometimes the proof that the access is safe is beyond what the compiler is able to represent. permalink fedilink source parent hideshow 2 child comments replies: [–] sem@piefed.blahaj.zone 1 point 10 months ago (1 child) Thank you for the correction, I'll edit my comment. sometimes the proof that the access is safe is bevond what the compiler is able to represent Could you say a few more words about this? In what situations do you have to write 'unsafe-tagged' code blocks? Could this be changed by improvements to the compiler? Or is it necessitated by the type of task being done by the code? permalink fedilink source parent hideshow 1 child comment replies: [–] CandleTiger@programming.dev 2 points 10 months ago Check out the excellent tutorial # Learn Rust With Entirely Too Many Linked Lists especially chapters five and six. It has a lot more words, it’s entertaining, engaging, and informative. permalink fedilink source parent
[–] hal_5700X@sh.itjust.works [S] 9 points 10 months ago (8 children) You say that. But the CVE is a memory corruption bug. permalink fedilink source parent hideshow 8 child comments replies: [–] dgriffith@aussie.zone 48 points 10 months ago (1 child) Which is worse? Entire driver written in a non memory safe language? The interface to the rest of the kernel is marked as unsafe and then the other X percent is safe from memory corruption? Surely if X > 0 then this is still a net improvement? permalink fedilink source parent hideshow 1 child comment replies: [–] sik0fewl@lemmy.ca 6 points 10 months ago I don't know, but I found this article interesting with respect to unsafe Rust - https://lightpanda.io/blog/posts/why-we-built-lightpanda-in-zig permalink fedilink source parent [–] JustAnotherKay@lemmy.world 9 points 10 months ago They’re not calling Rust unsafe. There is a memory safe mode and a memory unsafe mode in Rust, and this was built in unsafe Rust which allowed for the memory bug to be exploited permalink fedilink source parent [–] ryannathans@aussie.zone 2 points 10 months ago (4 children) You don't understand what unsafe means permalink fedilink source parent hideshow 4 child comments replies: [–] sem@piefed.blahaj.zone 8 points 10 months ago* (last edited 10 months ago) (3 children) Rust by default will not allow you to make certain kinds of errora, which is great. But if you are doing something advanced, down at the hardware level [see below], you might need to disable those defaults in order to write the code you need. This is what people mean by "unsafe" -- lacking the normal memory safeguards. With careful coding, "unsafe rust" or normal C, for that matter, can be free of bugs and safe. But if programmers make a mistake, vulnerabilities can creep in more easily in the unsafe sections. Is that basically it? permalink fedilink source parent hideshow 3 child comments replies: [–] CandleTiger@programming.dev 7 points 10 months ago (2 children) But if you are doing something advanced, down at the hardware level This part is wrong. Otherwise yes correct. The “unsafe” code in rust is allowed to access memory locations in ways that skip the compiler’s check and guarantee that that memory location has valid data. They programmer is on their own to ensure that. Which as you say is just the normal state of affairs for all C code. This is needed not because of hardware access but just because sometimes the proof that the access is safe is beyond what the compiler is able to represent. permalink fedilink source parent hideshow 2 child comments replies: [–] sem@piefed.blahaj.zone 1 point 10 months ago (1 child) Thank you for the correction, I'll edit my comment. sometimes the proof that the access is safe is bevond what the compiler is able to represent Could you say a few more words about this? In what situations do you have to write 'unsafe-tagged' code blocks? Could this be changed by improvements to the compiler? Or is it necessitated by the type of task being done by the code? permalink fedilink source parent hideshow 1 child comment replies: [–] CandleTiger@programming.dev 2 points 10 months ago Check out the excellent tutorial # Learn Rust With Entirely Too Many Linked Lists especially chapters five and six. It has a lot more words, it’s entertaining, engaging, and informative. permalink fedilink source parent
[–] dgriffith@aussie.zone 48 points 10 months ago (1 child) Which is worse? Entire driver written in a non memory safe language? The interface to the rest of the kernel is marked as unsafe and then the other X percent is safe from memory corruption? Surely if X > 0 then this is still a net improvement? permalink fedilink source parent hideshow 1 child comment replies: [–] sik0fewl@lemmy.ca 6 points 10 months ago I don't know, but I found this article interesting with respect to unsafe Rust - https://lightpanda.io/blog/posts/why-we-built-lightpanda-in-zig permalink fedilink source parent
[–] sik0fewl@lemmy.ca 6 points 10 months ago I don't know, but I found this article interesting with respect to unsafe Rust - https://lightpanda.io/blog/posts/why-we-built-lightpanda-in-zig permalink fedilink source parent
[–] JustAnotherKay@lemmy.world 9 points 10 months ago They’re not calling Rust unsafe. There is a memory safe mode and a memory unsafe mode in Rust, and this was built in unsafe Rust which allowed for the memory bug to be exploited permalink fedilink source parent
[–] ryannathans@aussie.zone 2 points 10 months ago (4 children) You don't understand what unsafe means permalink fedilink source parent hideshow 4 child comments replies: [–] sem@piefed.blahaj.zone 8 points 10 months ago* (last edited 10 months ago) (3 children) Rust by default will not allow you to make certain kinds of errora, which is great. But if you are doing something advanced, down at the hardware level [see below], you might need to disable those defaults in order to write the code you need. This is what people mean by "unsafe" -- lacking the normal memory safeguards. With careful coding, "unsafe rust" or normal C, for that matter, can be free of bugs and safe. But if programmers make a mistake, vulnerabilities can creep in more easily in the unsafe sections. Is that basically it? permalink fedilink source parent hideshow 3 child comments replies: [–] CandleTiger@programming.dev 7 points 10 months ago (2 children) But if you are doing something advanced, down at the hardware level This part is wrong. Otherwise yes correct. The “unsafe” code in rust is allowed to access memory locations in ways that skip the compiler’s check and guarantee that that memory location has valid data. They programmer is on their own to ensure that. Which as you say is just the normal state of affairs for all C code. This is needed not because of hardware access but just because sometimes the proof that the access is safe is beyond what the compiler is able to represent. permalink fedilink source parent hideshow 2 child comments replies: [–] sem@piefed.blahaj.zone 1 point 10 months ago (1 child) Thank you for the correction, I'll edit my comment. sometimes the proof that the access is safe is bevond what the compiler is able to represent Could you say a few more words about this? In what situations do you have to write 'unsafe-tagged' code blocks? Could this be changed by improvements to the compiler? Or is it necessitated by the type of task being done by the code? permalink fedilink source parent hideshow 1 child comment replies: [–] CandleTiger@programming.dev 2 points 10 months ago Check out the excellent tutorial # Learn Rust With Entirely Too Many Linked Lists especially chapters five and six. It has a lot more words, it’s entertaining, engaging, and informative. permalink fedilink source parent
[–] sem@piefed.blahaj.zone 8 points 10 months ago* (last edited 10 months ago) (3 children) Rust by default will not allow you to make certain kinds of errora, which is great. But if you are doing something advanced, down at the hardware level [see below], you might need to disable those defaults in order to write the code you need. This is what people mean by "unsafe" -- lacking the normal memory safeguards. With careful coding, "unsafe rust" or normal C, for that matter, can be free of bugs and safe. But if programmers make a mistake, vulnerabilities can creep in more easily in the unsafe sections. Is that basically it? permalink fedilink source parent hideshow 3 child comments replies: [–] CandleTiger@programming.dev 7 points 10 months ago (2 children) But if you are doing something advanced, down at the hardware level This part is wrong. Otherwise yes correct. The “unsafe” code in rust is allowed to access memory locations in ways that skip the compiler’s check and guarantee that that memory location has valid data. They programmer is on their own to ensure that. Which as you say is just the normal state of affairs for all C code. This is needed not because of hardware access but just because sometimes the proof that the access is safe is beyond what the compiler is able to represent. permalink fedilink source parent hideshow 2 child comments replies: [–] sem@piefed.blahaj.zone 1 point 10 months ago (1 child) Thank you for the correction, I'll edit my comment. sometimes the proof that the access is safe is bevond what the compiler is able to represent Could you say a few more words about this? In what situations do you have to write 'unsafe-tagged' code blocks? Could this be changed by improvements to the compiler? Or is it necessitated by the type of task being done by the code? permalink fedilink source parent hideshow 1 child comment replies: [–] CandleTiger@programming.dev 2 points 10 months ago Check out the excellent tutorial # Learn Rust With Entirely Too Many Linked Lists especially chapters five and six. It has a lot more words, it’s entertaining, engaging, and informative. permalink fedilink source parent
[–] CandleTiger@programming.dev 7 points 10 months ago (2 children) But if you are doing something advanced, down at the hardware level This part is wrong. Otherwise yes correct. The “unsafe” code in rust is allowed to access memory locations in ways that skip the compiler’s check and guarantee that that memory location has valid data. They programmer is on their own to ensure that. Which as you say is just the normal state of affairs for all C code. This is needed not because of hardware access but just because sometimes the proof that the access is safe is beyond what the compiler is able to represent. permalink fedilink source parent hideshow 2 child comments replies: [–] sem@piefed.blahaj.zone 1 point 10 months ago (1 child) Thank you for the correction, I'll edit my comment. sometimes the proof that the access is safe is bevond what the compiler is able to represent Could you say a few more words about this? In what situations do you have to write 'unsafe-tagged' code blocks? Could this be changed by improvements to the compiler? Or is it necessitated by the type of task being done by the code? permalink fedilink source parent hideshow 1 child comment replies: [–] CandleTiger@programming.dev 2 points 10 months ago Check out the excellent tutorial # Learn Rust With Entirely Too Many Linked Lists especially chapters five and six. It has a lot more words, it’s entertaining, engaging, and informative. permalink fedilink source parent
[–] sem@piefed.blahaj.zone 1 point 10 months ago (1 child) Thank you for the correction, I'll edit my comment. sometimes the proof that the access is safe is bevond what the compiler is able to represent Could you say a few more words about this? In what situations do you have to write 'unsafe-tagged' code blocks? Could this be changed by improvements to the compiler? Or is it necessitated by the type of task being done by the code? permalink fedilink source parent hideshow 1 child comment replies: [–] CandleTiger@programming.dev 2 points 10 months ago Check out the excellent tutorial # Learn Rust With Entirely Too Many Linked Lists especially chapters five and six. It has a lot more words, it’s entertaining, engaging, and informative. permalink fedilink source parent
[–] CandleTiger@programming.dev 2 points 10 months ago Check out the excellent tutorial # Learn Rust With Entirely Too Many Linked Lists especially chapters five and six. It has a lot more words, it’s entertaining, engaging, and informative. permalink fedilink source parent