[HN Gopher] Heap Overflow in OpenBSD's Slaacd via Router Adverti...
___________________________________________________________________
Heap Overflow in OpenBSD's Slaacd via Router Advertisement
Author : gray_charger
Score : 44 points
Date : 2022-03-24 15:08 UTC (7 hours ago)
(HTM) web link (blog.quarkslab.com)
(TXT) w3m dump (blog.quarkslab.com)
| _wldu wrote:
| I wonder if the OpenBSD team would be open to Go or Rust
| implementations?
| flatiron wrote:
| > Such ecosystems come with incredible costs. For instance,
| rust cannot even compile itself on i386 at present time because
| it exhausts the address space.
|
| is that really a reason not to use it? nobody is using i386
| anymore that is updating to the latest openbsd.
| volkadav wrote:
| does amd64 provide a benefit for virtual machines with less
| than 4gb of ram provisioned? (e.g. i have a small bastion
| host on obsd 7.0, and even 256mb of ram is slightly overkill
| based on what i've seen so far of resource usage)
| IcePic wrote:
| Yes, the larger amount of cpu registers, the very much
| larger virtual memory space adds performance and security
| benefits, regardless of if you have less or more than 4G
| ram.
| snvzz wrote:
| I know at least one person who's using openbsd _precisely_
| because it is a low-maintenance and relatively safe option
| that still supports their i386 hardware.
| flatiron wrote:
| is there any reason they are still using i386 hardware? i
| can think of a million reasons to upgrade but not many to
| stay
| snvzz wrote:
| It's a laptop with a 32bit cpu. It works for its task, as
| well as it did when it was purchased. It uses very little
| power. It has an integrated UPS (laptop's battery).
|
| There's absolutely no reason for them to retire that
| hardware and buy something newer to replace it.
| slackfan wrote:
| Not polluting the planet and being a rampant consumer for
| one is a very good reason not to upgrade.
|
| If one is to actually use a computer not as a glorified
| web terminal, you'll find that for most things that
| aren't video/audio/image editing computing _power_ really
| stopped being relevant after about 1998.
| rhexs wrote:
| An i386 will use more power than a far cheaper server
| that's still 100x as powerful.
|
| It would be more "sustainable" to upgrade.
| slackfan wrote:
| Kind of had to beat a 2W power draw, tbph.
| [deleted]
| anthk wrote:
| Image editing can be fast enough on a Pentium 3/4 up to
| 1280x800 and imagemagick.
|
| For audio/video, a Pentium 3 or similar would be enough
| with a good video card, some mplayer/mpv settings to skip
| the loop filter on decoding and video should be good
| enough up to 720p on Pentium 4 with SSE2 or pre 2010
| Celerons. Celerons from 2010 and beyond can play 108p at
| 30FPS without sweating.
|
| EDIT: I use Slackware and OpenBSD too :D.
|
| Fluxbox, Rox, XTerm, Mocp, Djview, MuPDF, Groff+MS,
| Bitlbee+sic... you don't need a high end machine, for
| sure.
|
| For Rox: mkdir ~/lib cd ~/lib
| git clone https://github.com/jun7/VideoThumbnail
| mkdir -p ~/tmp cd ~/tmp git clone
| https://repo.or.cz/rox-lib.git cd rox-lib
| cp -r ROX-Lib2 ~/lib
|
| Done. Add Zukitre for GTK2/3 themes, the Zukitre theme
| for Fluxbox (I have a fork for the theme with better
| settings), lxappearance and maybe Elementary/Tango2+Tango
| icons as a base for Tango2 icons, and you'll have an
| elegant and blazing fast desktop.
|
| If any, you can install fbmenugen and config it to set
| some automatic XDG menu entries and some of them to
| suspend/hibernate your laptop.
| slackfan wrote:
| I still have an old G4 powermac hanging around to do most
| of my image and audio editing in under (gasp) OS9 no
| less. I can still do huge modern-pixel-count images with
| Photoshop 6 just fine, because I don't really care about
| 10bit color or whatever the hell the kids are up to these
| days.
|
| But then again, we're talking about computers, not media
| consumption machines.
| tedunangst wrote:
| Of course people are still updating.
| steveklabnik wrote:
| Unlikely, at least for Rust.
| perihelions wrote:
| Here's a long thread about that (the short answer is "no"),
|
| https://news.ycombinator.com/item?id=23059477 ( _" Theo de
| Raadt on Rust"_ / _" Integrating "safe" languages into
| OpenBSD?"_, 389 comments)
| jeffbee wrote:
| Function is such a mess. Even C++ would clean this right up, and
| then you'd actually be able to read it. I'm not even going to
| claim this is beautiful or flawless or whatever, but _to me_ this
| kind of C++ is head and shoulders above the C code in the article
| in terms of readability.
|
| https://godbolt.org/z/Mfnxq15Ma
| pjmlp wrote:
| Battling that trumpet since 1994, but here we are, with enough
| systems still using bare bones C.
| jms703 wrote:
| I love the fast turnaround time from the report to the release of
| the patch.
| gjadi wrote:
| > The OpenBSD team states that they consider that the
| vulnerability would be exploitable if there weren't severe
| privilege separation and pledge involved.
|
| Yay!
| Rendello wrote:
| I'm a big fan of OpenBSD's pledge and unveil syscalls; the best
| overview of them is from SerenityOS' implementation:
|
| https://awesomekling.github.io/pledge-and-unveil-in-Serenity...
___________________________________________________________________
(page generated 2022-03-24 23:02 UTC)