CISA Warns of Linux Kernel Use-After-Free Vulnerability Exploited in Attacks to Deploy Ransomware

AliasAKA is correct, it’s actually 5.14, not 5.15 like I thought.

You’re right, it’s 5.14 not 5.15 like I thought. I’m spending most of my time im Debian these days though, so I’m glad I wasn’t too far off.

Sweet, cheers for checking - I just remembered it being on 6.1.?

Unfortunately, it's not that simple, because attacks often involve "exploit chains". In this case, an attacker would use a different vulnerability to gain code execution capability, and then use that capability to exploit this vulnerability.

Update your systems, folks.

No. They just have to be able to place exploit code onto your machine and have it run.

Not directly, but as other comment has mentioned, it reduces the overall security posture because it could be combined with other flaws known and unknown.

They're replying to the victim blaming mentality of "if you let them then you have bigger problems" in your comment. Not your point about it being less dangerous than remote execution.

I'm referring to the ageism implied in the statement, I don't care about C vs Rust any more than I care about vi vs emacs or KDE vs Gnome.

Old fuckers have experience, they have seen many next big things come and go, that's why they seem slow to adopt new stuff. Of course this annoys new fuckers a lot, as they want to play with their new shiny toys now.

Patience is a virtue, young grasshopper.

Ooh, so "get out with this Rust, I ain't gonna think about when writing my code" is protecting a baby now?

https://dlang.org/

This language was there for a lot longer than Rust, and is not "OCaml, but with curly braces for scopes".

It's never too late to start!

Duh, by wrapping it in an unsafe block.
Boom.

Easy. Do some specific incantation that barely looks like it follows rust syntax that is specifically made to exploit a bug in the rust compiler.

Yes, that's right. You cannot have a UAF situation unless you're using unsafe "escape hatch" tools.

C++ would also solve this for the same reason!!

Rust still has memory related bugs

Improbable. Everything has bugs that surface. See my other link, or look yourself. There have been plenty of security fixes for Rust. It's not bulletproof, just like anything else, just less likely specifically for certain memory attacks to be vectors.

It is still possible to have security vulnerabilities in Rust

WOW. No, it would make it improbable. It's not like there can't be zero-days for Rust, bud. This particular attack vector deals with memory handling, and sure, Rust's main feature is memory security and management. Doesn't mean there aren't bugs to exploit there.

https://linuxsecurity.com/features/rise-of-rust-based-malware

Rust is a programming language which was designed to be memory safe without any of the overhead caused by traditional memory safety techniques employed by existing languages (namely, garbage collection and reference counting). It does this by shifting the memory management from happening at runtime to happening at compile time. The compiler forces the programmer to follow certain rules to ensure that their program can be proven to be free of errors such as use-after-frees and double-frees. Because of this design philosophy, Rust is a good fit as a replacement for C, because it can do everything that C can while ensuring the programmer doesn't make any mistakes with regard to memory management.

Rust is a programming language. Not to be confused with the video game.

This is a joke right

I hacked it. The screen said “It is now safe to turn off your computer.” but I left it on instead.

That one time that Clippy started peeling off it's flesh whilst chanting in reversed Latin and also wasn't in the computer anymore.

(This was after I let it play that Flash with the Badger song for two weeks so I kinda understand what happened.)