Hacker News Reader

Comment by hinkley | Hacker News Reader

Ouch. If data structures require unsafe operations, doesn't this make Rust's safety a 90/10 solution, and leave a small but credible threat of what are effectively buffer overflow attacks?

Look at all of the programming languages that have had to reimplement their hash tables because someone figured out that you can DDOS a web server by sending requests with just the right query parameters. If there's a bug in hash resizing and it's unsafe code, what could someone make of that?

View on HN

Probably unlikely. There was that thread::scoped issue last year right before 1.0 where some incorrect assumptions lead to an unsafe API that was thought safe. But it was unlikely to happen to app code and be exploitable.

I examined every MS security bulletin over a 2 year period. Nearly all the serious ones were regular C/C++ code memory corruption issues. From what I could tell, Rust would have prevented every one.

MS's .NET had a few serious bugs. They were basically all class loader logic bugs (XBAPs getting more permissions, ways to bypass the CAS system). It's similar to the Java plugin issues: Java applets themselves were never exploitable. But the plugin might accidentally let you do things you're not supposed to. The most user-impacting was stuff in ASP.NET, which is more like an app framework, not a runtime. (There were some "load up arbitrary code/read arbitrary file" bugs IIRC, caused by bad crypto and logic.)

I actually found probably the first memory safety CLR bug[1]. If you loaded a function pointer of an un-jitted function, you could end up with a safe/verified pointer (delegate) to unmanaged code. So there's a true issue, where the implementation is letting you escape and do unsafe things while saying it's verified. But, there's basically no way for this to turn into an app-level security issue. The only use was to escape the .NET code-level sandboxing (CAS).

1: Well to my knowledge -- none were published before. But neither was this one so who knows how many there actually were.

> If data structures require unsafe operations, doesn't this make Rust's safety a 90/10 solution, and leave a small but credible threat of what are effectively buffer overflow attacks?

Somewhat gibly, every solution is a 90/10 solution (with different exact numbers of course): there has to be some assumptions/assertions buried in the system somewhere. For instance, correctness of the runtime/built-in types in "safe" languages like Python or Java or Haskell, behaviour of the operating system when doing syscalls (or behaviour of specific machine instructions), or even bug-free-ness of a theorem prover used. Obviously different classes have different rates of errors, but it is still very useful to reduce and focus the places where incorrect assumptions can lead to "critical failures" (memory safety ones) even if one doesn't/can't sink the effort/money into reducing it to (essentially) zero. All of these systems are a tradeoff in some sense, between guaranteed-correctness and things like performance, "productivity", and cost of development.

Rust's power is its ability to significantly narrow the places where memory unsafety is a risk without imposing a cost ("zero cost abstractions"), but still giving all the convention control and power needed for systems programming. There is of course the risk of those places having bugs, but they're explicitly marked and exhaustively testing/auditing the 100 lines of code that build safe abstraction is easier than a whole 1000 or 10000 application that uses it.

> that you can DDOS a web server by sending requests with just the right query parameters

The HashDOS problem is not a memory safety one. In some sense, it isn't even a bug in the implementation but rather the design. The problem arises from using a poor/predictible hash function that allows an attacker to construct many values with the same hash, even if the hash table and the hash function itself are implemented 100% to spec. It is... difficult for a programming language to protect against spec bugs, especially because what is a bug/not helpful sometimes might be desirable at other times.

(Incidentally, Rust's HashMap actually defends against this by default, using SipHash with random keys, which is why it lags behind, say, C++ in some benchmarks that use the default data structures.)

For example:

I found a trivially exploitable buffer overrun in the Source game engine. The cause? Somebody used strcpy instead of strncpy... when adding an animated ellipsis at the end of a string.

You really have to try in Rust to get pwned adding an ellipsis to a string.

(And yes, tools should (and probably would) have caught that bug. But they either weren't used, or didn't catch it, so...)

Quis custodiet ipsos custodes?

> If data structures require unsafe operations, doesn't this make Rust's safety a 90/10 solution, and leave a small but credible threat of what are effectively buffer overflow attacks?

No worse than JavaScript, Perl, PHP, Python, Ruby, Go, ..., all of which implement their hash tables in C.

How many production server side apps do you know of that have been compromised due to memory safety problems in the core hash table data structure?

Go's implementation is in Go + may be some assembly.

That doesn't make it immune to memory unsafety, because the initial implementation had to be written in something other than Go, namely C. And the current compiler was compiled by an older compiler, which was itself compiled by an older one, ..., which was itself compiled by the initial Go compiler, written in C.

Are they seriously not using an interpreter to compile the current version with itself?

"Reflections on Trusting Trust", Ken Thompson.

https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thomp...

Reply on news.ycombinator.com