[a / b / c / d / e / f / g / gif / h / hr / k / m / o / p / r / s / t / u / v / vg / vm / vmg / vr / vrpg / vst / w / wg] [i / ic] [r9k / s4s / vip] [cm / hm / lgbt / y] [3 / aco / adv / an / bant / biz / cgl / ck / co / diy / fa / fit / gd / hc / his / int / jp / lit / mlp / mu / n / news / out / po / pol / pw / qst / sci / soc / sp / tg / toy / trv / tv / vp / vt / wsg / wsr / x / xs] [Settings] [Search] [Mobile] [Home]
Board
Settings Mobile Home
/g/ - Technology


Thread archived.
You cannot reply anymore.


[Advertise on 4chan]


File: 1776900434461731.jpg (488 KB, 1570x2284)
488 KB JPG
Mythos Rust review leak

https://github.com/Swival/security-audits/tree/main/rust-stdlib#rust-standard-library-audit-findings
>>
bump for later
>>
kys tranny
>>
>>108706304
kys? kiss your sister? my trans sisters? sure! :3
>>
>>108704649
>>
>>108704649
Anons love these pov images of anime girls eating greasy foods because in reality anons are fat gross pigs. Those anime girls would hate you if they existed.
>>
>>108706284
>bump for later
Gave a quick look to the supposed 27 "High" entries. I don't have the time for deep dives. But here are some notes.

1st/2nd (related) are in the fortanix/sgx platform abstraction
3rd is in the μITRON platform abstraction
4th is in the ITRON solid_asp3 platform abstraction, and I think it's a normal bug because conversion method in sys::net has an assertion that would prevent invalid reads
5th is the Xous platform abstraction
6th is again in the fortanix/sgx platform abstraction
7th/8th are in the Hermit OS file-system abstraction
9th is in the μITRON file-system abstraction
10th is in the VxWorks process abstraction.
11th is in the Motor OS process abstraction
12th is in the zkVM IO abstraction
13th/14th are in the Xous synchronization abstraction
17th is in the zkVM env abstraction
18th is in the fortanix/sgx args abstraction
19th is in the UEFI os env abstraction (scary!)
25th/26th are in compiler-builtins linux/ARM emulation which is only enabled in pre-ARM6 processors and deprecated android ABI

this reads more like an ad for rust portability than a laundry list lol

Potentially relevant stuff:

15th/16th are in dwarf personality code, and could be of interest. I may give them a deeper look later, or wait for experts to chime in.

20th/21st are in AArch64 NEON abstractions and require #[target_feature(enable = "neon,rcpc3")]

22nd and 23rd look like GOOD FINDS which are easy to reproduce in iterator code. Although they require an unstable feature and doing next_chunk::<0>() which probably shouldn't be allowed API-wise.

24th is a possible good find also in iterator code (and also requires an unstable feature). Reproducer is a "standalone equivalent", which probably means this bug can't be triggered from the outside.


27th is in unwind code with the condition "targets where executable memory is not readable", with a claim that it can be triggered in Xous.
>>
>>108706847 (Me)
>22nd and 23rd look like GOOD FINDS which are easy to reproduce in iterator code. Although they require an unstable feature and doing next_chunk::<0>() which probably shouldn't be allowed API-wise.

// trivial reproducer for 22nd since one wasn't included
#![feature(iter_next_chunk)]

fn main() {
let _ = dbg!{
std::iter::once(true)
.filter(|_| true)
.next_chunk::<0>()
};
}


Note that ^this^ doesn't trigger with the release profile. Read this if you're interested in why:
https://doc.rust-lang.org/nightly/std/mem/fn.needs_drop.html
>>
>>108704649
btw, how is this a "leak" if it was done by Swival, and published by Swival?
>>
File: kys.png (266 KB, 624x534)
266 KB PNG
>>108706304
>>
>>108706498
Is there anything like One Piece's sea stone in Frieren? Otherwise that's just unrealistic.
>>
>>108704649
eh, using trillions of dollars amount in something worth maybe one billion
someone pass that on freecad
>>
>>108706886
ai discovered all those defects. now someone has to go over them and verify their validity i guess?



[Advertise on 4chan]

Delete Post: [File Only] Style:
[Disable Mobile View / Use Desktop Site]

[Enable Mobile View / Use Mobile Site]

All trademarks and copyrights on this page are owned by their respective parties. Images uploaded are the responsibility of the Poster. Comments are owned by the Poster.