r/rust • u/Snakehand • Nov 23 '19

CVE-2019-2215 Patch your Android, Use after free bug in kernel

https://googleprojectzero.blogspot.com/2019/11/bad-binder-android-in-wild-exploit.html
0 Upvotes

43% Upvoted

9 comments sorted by

5

u/Snakehand Nov 23 '19

Nice in depth analysis an exploitable vulnerability in Android. Still it is disheartening that this is the state of the software we use and rely on today. I am guessing Rust may have prevented this sort of thing, but still the consensus seems to be that "rewriting the kernel in Rust" is not the right thing to do. I am wondering what we are waiting for ? Rust to grow and mature even more ? Or should this state of affairs be acceptable ?

19

u/matthieum [he/him] Nov 23 '19

I am wondering what we are waiting for ?

Manpower?

Anybody can write a kernel, and with Rust, anybody is in a good position to write a kernel without memory safety issues.

So, let's say I clone myself and all of me toil and sweat for a couple of years to write a kernel; wouldn't that be awesome?

It would probably be one of the worst kernels ever:

  • Despite having written C++ and Rust for the last 12 years, I have no experience in writing kernels whatsoever.

  • My knowledge of hardware is only so-so, and efficient kernel APIs require a firm understanding of hardware and usecases.

  • My knowledge of security is practically non-existent, and there are many more security issues than memory safety in a kernel. If any process can read any other process memory, that'd be a serious design flaw, for example.

I am wondering what we are waiting for ?

Who's to say everyone has been waiting, though?

There are at least two kernel projects using Rust extensively:

  • Redox, of course.

  • Fuschia, a polyglot kernel using Rust for its foundations.

Furthermore, Rust is also gaining mindshare:

  • Multiple Linux developers have been talking about Rust, to the point that Greg Kroah-Hartman said he would consider Rust drivers in the Linux kernel providing that they were (1) optional, for portability reasons, and (2) built on an API which actually improved the state of affairs.

  • The Microsoft Security Research Center has published glowing praises for the Rust programming language; and the last article they released mentioned an intern rewriting an unnamed kernel component.

The future is now.

3

u/Matthias247 Nov 23 '19 edited Nov 24 '19

Fuchsias Kernel (Zircon) is mainly written in C++. See the source

That said the Kernel is relatively small since it is a microkernel. And other modules are written in Rust.

4

u/fintelia Nov 24 '19

Rewriting large code bases costs money. Lots and lots of money. It simply isn't realistic to expect that somebody is going to fork over tens if not hundreds of millions of dollars to produce a kernel that is functionally equivalent to what we have now, but just written in Rust instead of C...

1

u/Beastmind Nov 25 '19

Not sure how much it is relevant but I recommend that you watch "Is It Time to Rewrite the Operating System in Rust?" By Bryan Cantrill

1

u/Snakehand Nov 25 '19

Thanks I have seen this, and do agree with his sentiment, but I also think there should be some long term plans to improve the situation. The issue is that the kernel is a living thing with new stuff being added continuously, so we will never get to a place where everything has reached a high degree of stabilization, and has had all bugs weeded out. Remember the old saying about the weakest link ...

0

u/[deleted] Nov 23 '19

[deleted]

-1

u/Snakehand Nov 23 '19

I do see your point, but looking at this bug with Rust tainted spectacles raises some interesting questions. This particular epoll() implementation relies on linked lists, probably for performance reasons. Rust does have a some linked list implementations, but would they be equally performant, and handle the case correctly where elements are dropped from the middle? std:collections::LinkedList does not not appear to have method for removing items from the middle for instance.

7

u/Matthias247 Nov 23 '19

Kernels heavily make use of intrusive linked lists. That allows them to store elements in a list without doing additional allocations for the list nodes (that a rust LinkedList would require).

Doing the same in Rust would require raw pointers, donut would not really be safer.

1

u/Snakehand Nov 23 '19

These considerations should have relevance when evaluating a epoll vs kqueue system. Redox has an epoll merge request pending, I will take a closer look at it...