Out-of-bounds write in systemd-resolved with crafted TCP payload (opens in new tab)

I'd love to learn Rust by opportunistically implementing parts of the systemd API.

If any Rustafarians start such an effort, please make some noise about it.

Because if it's good enough for OpenBSD, then it's good enough for us.

Because of the many years of development already put into them?

Re-writing things in a memory safe language takes a lot of time. And that's even if the language is stable and available cross-platform.

Because all other languages have higher overhead or are less stable.

Yeah, we really should rewrite the kernel.

Because Poettering and his fanboys like it, and nobody's implemented anything sufficiently better to overcome the political sway of the freedesktop.org crowd.

"A malicious DNS server can exploit this by responding with a specially crafted TCP payload to trick systemd-resolved in to allocating a buffer that's too small, and subsequently write arbitrary data beyond the end of it."

When your program doesn't handle a malformed input, and this leads to a buffer overflow, it's your fault. When this program is something as important as systemd, the problem is even worse.

Anything Internet-facing has to accept any kind of packet without crashing, or at least without failing in an exploitable way. That's the bare minimum you-must-be-this-tall entry requirement of security.

Both are Germans, and work at RH.

Frankly the more i look at things, the more i find a small group of people at the RH German office to be the source of recent turmoil.