117
you are viewing a single comment's thread
view the rest of the comments
[-] TheTechnician27@lemmy.world 29 points 2 days ago* (last edited 1 day ago)

I mean yes, I do, given safe Rust inherently fixes seemingly every exploit listed in this article:

  • ~~RCE from integer overflow (not possible by default in Rust, CVSS 9.0)~~
  • RCE from a race condition (not possible in safe Rust, CVSS 9.0)
  • An exploit of a buffer copy
  • An out-of-bounds write leading to local privilege escalation
  • Using an uninitialized resource
  • TCP query stack buffer overflow leading to local privilege escalation

I feel like it's the 1960s and I'm being told "we get it, you like seatbelts".


Edit: Sorry, re: the first one. I was misremembering based on a mix of a few things (see below). It does this in debug mode (which in itself is good to have), and it won't compile if it can detect an overflow statically, but it's not checking over/underflow at runtime by default. It can do this if you want it to, but that's an inherent speed penalty from C. I was thinking of Swift, which does automatically detect integer under/overflow at runtime unless you explicitly tell it not to on a per-operator basis.

In the spirit of not making you "trust me bro" since I was so wrong about the integer under/overflow one, here's Rust's overview of how safe Rust guarantees against data races.

[-] LaggyKar@programming.dev 6 points 1 day ago

RCE from integer overflow (not possible by default in Rust

It is possible. Rust will check for overflow and panic in debug builds, but will silently wrap integers in release builds.

[-] TheTechnician27@lemmy.world 2 points 1 day ago* (last edited 1 day ago)

Yeah, you're right. I was thinking of a combination of Rust's debug mode, the fact it won't compile if it detects a static under/overflow, and Swift's default producing a runtime error on integer under/overflow. Corrected; I apologize.

[-] diaphragmwp@discuss.tchncs.de 1 points 1 day ago

OpenBSD makes pointless seemingly every exploit listed in this article (correct me if I am wrong). The lead is anti-rust.

this post was submitted on 22 Oct 2026
117 points (100.0% liked)

Linux

15293 readers
440 users here now

A community for everything relating to the GNU/Linux operating system (except the memes!)

Also, check out:

Original icon base courtesy of lewing@isc.tamu.edu and The GIMP

founded 3 years ago
MODERATORS