145
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 29 Oct 2026
145 points (100.0% liked)
Programming
29080 readers
358 users here now
Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!
Cross posting is strongly encouraged in the instance. If you feel your post or another person's post makes sense in another community cross post into it.
Hope you enjoy the instance!
Rules
Rules
- Follow the programming.dev instance rules
- Keep content related to programming in some way
- If you're posting long videos try to add in some form of tldr for those who don't want to watch videos
Wormhole
Follow the wormhole through a path of communities !webdev@programming.dev
founded 3 years ago
MODERATORS
This specific issue would have been prevented with with Rust.
So could have Java, Go, C# or any language with GC. With garbage collection, the options object stays alive as long as any CPU holds a pointer to it, so use-after-free can't happen.
Besides, this exploit is so hard to pull off the only realistic outcome is a kernel panic, and that hasn't even been publicly demoed.
No. Those aren't allowed in Linux Kernel.
Garbage Collection is not usable in an operating system Kernel.
Clearly, but it's worth pointing out that this kind of problem isn't uniquely fixed by "just use Rust".
I never said that only Rust prevents this. I just said using Rust in the Kernel would have prevented this issue.
Fair enough. Don't you think it simplifies the issue a little bit? How long would it take to rewrite the entire TCP stack in rust?
I don't think a rewrite in Rust is necessary for everything that has a bug. Instead fixing the bug is probably more secure, before such alternative Rust code is mature enough to replace it.
Rust haters in shambles
lol no, Rust itself is AI now btw
This is an issue from 2019?
Still open? Only tagged in 2024?
How makes this rust ai?
It doesn't. It's just a separate fact that Rust allows LLM generated code in. The common argument is that Rust doesn't make everything it touches secure.
No one said Rust makes everything it touches secure. You should stop thinking in black and white. I said this specific issue would not have happened with Rust, because Rust catches this type of issue at compilation time.
This type of issue is called use-after-free.
I sent a link to a use-after-free bug in RedoxOS, the OS advertised as being written in Rust for security. The issue is tracked as CVE with severity 7.8.
That's a bug.
So is this one in Linux.
Unsafe allows that, yes.