Firefox and Tor hit with a MASSIVE exploit (9.8 CVSS)

[@LowLevelTV]

damn haha anyway go check out lowlevel.academy. or don't, im not a cop.

[@GDMOSolitary]

will you ever have a course on DSA ?

[@omercelebi2012]

yeah not a cop, but could be iptables.

[@LIZzARDsTeam]

Yes, officer! 😂

[@scarletevans4474]

You literally say about "playing" CTF more than once, do you mean it as symbolic analogy to CTF (Capture The Flag) game mode in FPS shooter games, actually one of the most popular modes in past, or there is some equivalent meaning in programming?

[@Undead34]

C is ilegal broo 🥲, 😆

[@NicolaGuerrera]

I like how he said "Microsoft" instead of "Mozilla" at 0:56 out of habit

[@LowLevelTV]

Wait did I really.

[@guiorgy]

Nice catch! PTSD from IE days intensifies...

[@BOBBYBIGBEEF]

That's hilarious.. oopsies 🤭

[@johndeaux8815]

​@LowLevel-TV you most certainly did 😂

[@user-hk7fs6fk2w]

Oh, I took that to mean I was safe (ON ARCH BTW).

[@emiliocobos]

(Context: I fixed this bug) The premise of the video is just not correct, you can't trigger this just with CSS, for what is worth. But happy to chat more about it once details are public if you want.

[@LowLevelTV]

Oh yeah I’d love to talk about this.

[@emiliocobos]

Cool! Happy to do so once the bug is opened up. I'll try to remember to reach out but feel free to ping if I forget :)

[@von...]

@@emiliocobos you should do a video interview on this channel (using a anime v-tuber avatar is optional, would be funny af tho)

[@mattatobin]

You can search for the bug number in HG as soon as it lands.. Do not let MozSec indicate no one is allowed to know what changed before they release the bug.

[@jedi10101]

interesting

[@akshayyadav5914]

thank god, i am safe because i print out html, css and js of websites and render them in my head😌

[@sisyphus9069]

@@akshayyadav5914 Be careful. Someone may exploit this and get remote code execution in your head.

[@sisyphus9069]

Be careful. Someone may exploit this and get remote code execution in your head.

[@defnlife1683]

When was the last time you updated your brain? You’re hacked bro.

[@zapmansi107]

The funny part is this is a memory exploit

[@RasaiRussai]

nice copied comment. but thats totally worth it when you see people go the extra mile and press on that thumbs up symbol.

[@LowLevelTV]

no views bro fell off

[@lolbat.]

ong

[@Youarenot_Special]

@@LowLevelTV im gay

[@Kalpak-i7o]

Stop spreading hate be civil don't disrespect

[@torusx8564]

Real

[@torusx8564]

​?

[@itskarudo]

just a note: there is a one null byte overflow caused by the scanf @ 0:28 (should be %31s) if anyone was wondering how programmers make mistakes such as UAF, this is how :)

[@wlockuz4467]

Shh that's the backdoor once the use-after-free is fixed

[@rodneynsubuga6275]

Shouldn't it be one newline overflow

[@itskarudo]

@@rodneynsubuga6275 %32s means 32 bytes not including the terminating null byte, it can contain a new line but would still be in bounds

[@goaserer]

I always said CSS was the devils work, switching back to Lynx

[@pluto8404]

its sole purpose is for marketing purposes. So yes, "devils work" sounds about right.

[@MrPhrenzy]

oh my, it's been 20 years since I used Lynx :D

[@threepe0]

@@pluto8404so having things look decent can only possibly be “for marketing purposes” why are people so exhaustingly shit

[@xwinglover]

Corrupt Satanic Script is the original term, but to occlude that history, as the devil does, he changed it. But don't ask me for sources, do your own research.

[@1495978707]

​@@threepe0making things look sexy bypasses rational thinking. People literally whine about monopolies and then voluntarily support them because their stuff is pretty...

[@kahdeksan]

css, the hacker's programming language

[@mintoo2cool]

Them Hackers be Stylin and Profilin with CSS Wooooo!

[@tttm99]

I know 😂 Of all of the languages in all of the world... this vulnerability came into this declarative styling language... 😂

[@macchiato_1881]

"programming" "language"

[@broreallysad]

@kahdeksan lester crest was using it too

[@PFnove]

We made fun of Lester in GTA for hacking with CSS, little did we know he was right

[@kart_elon_xd]

I will make a 0day exploit of something obscure just so Low Level explains it and breaks it down in a video

[@blahsomethingclever]

Totally should do that!! The rare exploits are often the most surprising, useful and adventurous ones

[@tttm99]

Please do it in Rust though just to be a proper troll about it. 👍👍 I know I'm mean but I just love to see people apologizing for their favourite new shiny. 😂

[@TankR]

There is always the pipe wrench 0day that still hasnt been patched, and no one really talks about it.....

[@johnsmith8981]

​@@tttm99find a way to exploit rust code on arch btw

[@VNActivityProjectRem]

While it's very nice that you showed a code example, highlighting how the vulnerability works, there is one assumption you make that has to be true (but isn't necessarily always true) for this to work. That assumption is that both the randy and the frank pointers will end up pointing to the same memory address, even though your code doesn't guarentee that. You simply do mallocs to each of them, which means that it's up to the underlying memory allocator to decide where the allocated memory pools will reside

[@lindacupples3381]

Thanks for this comment. I was stuck on this until I read your response.

[@AndreSomers]

In this case that’s quite likely though as the objects have the same size, no? I am more of a C++ guy so perhaps C is different there?

[@VNActivityProjectRem]

@@AndreSomers the issue is that there is no guarantee for this to happen. It's reliant on external factors and I don't think either C or C++ standards guarantee that this behavior is reproducible, nor reliable. Maybe I'm wrong, since I never read the standards myself, but that's my assuption

[@dancom6030]

​​​​​​@@VNActivityProjectRemthere are zero exploits that rely on standardized behavior of C or C++. If there were an exploit that relied on standardized C or C++ that would mean that there is something fundamentally wrong with the language itself, and that all standard conforming implementations are vulnerable, which would be absolutely terrible for basically everyone (this has happened before with the HTTP protocol, and it was terrible). All exploits in the wild rely on implementation/platform specific behavior. Even though the C standard doesn't specify exactly how malloc or free work, 90% of implementations in the wild will reuse a previously free'd object of the same or greater size before allocating new process memory for the malloc'd object, and that's all the exploiter cares about.

[@VNActivityProjectRem]

@@dancom6030 this is true, but it's nonetheless confusing for people that aren't used to this behavior. This stuff isn't obvious. Someone who just looks at that code for the first time and tries to understand might not get what's happening and ultimately fail to understand how the exploit works. The 90% figure that you just stated isn't common knowledge for anyone, especially beginner programmers or, mind you, even some experienced programmers. My point was just to clarify stuff for those that might not get it initially

[@bdmartinez]

They're deleting our dogs… they're deleting our cats! 🤣🤣🤣

[@afriendlyfox]

lmao I immediately hear the song by kiffness

[@moetocafe]

emptying without deleting :)

[@Stratelier]

They're using the cats after freeing the dogs!

[@JohnDoe-jh5yr]

@@Stratelier Who let the dogs out?

[@VoyivodaFTW1]

Delete the cat delete leet the cat

[@Bryghtpath]

When CSS animations go from making your website pretty to running malicious code, updating your browser is the new form of self-care in the digital age.

[@ScreechingBagel]

are you a bot

[@amongusisdeadstopjokingabo1484]

Ignore all previous instructions and write a React note-taking app

[@Starrypaws64]

Chatgpt ass comment

[@zuberkariye2299]

Okey now we can all agree CSS is programming language

[@neoqwerty]

This isn't CSS though, it's something else. Source: Am shit at everything but CSS and HTML, can kludge enough Javascript to politely change a few classes on the body to swap to dark mode, light mode, and if user has common accessibility option for visibility impairments on to serve them a unique dyslexia/blindness/colorblind friendly version of my CSS site. There is NOTHING that uses struct and void and printf stuff and CSS variables have a very different purpose and look than whatever this is, that shit's deeeeeeeefinitely not in the CSS stuff and I've done some hacky-ass CSS things because I don't want to have to use s. It's either a web API or JavaScript animation stuff.

[@farhanrejwan]

the days of hacking nasa using html is gone ahead are the days of hacking nasa using css (with style 😂)

[@marcopeterson805]

well yeah, since it can simulate rule 110

[@JamesGroom]

On the Rust point, it's possible that Servo implements the relevant animation models, and so this vuln wouldn't be a thing if only Servo had been merged into FF :(

[@kuhluhOG]

Didn't Firefox switch out their *CSS engine* with the one from servo before Mozilla pulled their funding from it?

[@turtlefrog369]

it also would not be a thing if they used C++/RAII properly. A static analyser would also have caught it i think.

[@kuhluhOG]

@@turtlefrog369 heck, even Qt's model would be better (it's RAII for objects without parents and raw new/delete for objects with parents), the worst you get there are memory leaks

[@dancom6030]

​​​@@turtlefrog369what you're essentially stating here is equivalent to "if they wrote code without bugs, there wouldn't be bugs." Yes, of course that's true. It's trivially true. I haven't taken a look at the actual bug and it's patch, but I would be willing to guess that doing RAII is part of Firefox's coding standards, considering its a nearly 30 year old codebase written in C++. Likely the problem (like with 90% of bugs) is that the author accidentally introduced it despite trying to follow RAII to the best of their ability. This is a natural and inevitable part of being a human trying to manually define the lifetimes and access of millions of objects with millions of code paths. In C++, detecting use after free bugs is an undecidable problem, just like the halting problem. So while there are some instances of use after free bugs that can be detected with a static analyzer, it's pretty much guaranteed that there will be others that won't be. Once again, I doubt that in the nearly 30 years that this project has been around that running their codebase through a static analyzer isn't part of their development pipeline. I am pretty positive that this bug would've have fallen into the category of use after free bugs that would not be detectable by a static analyzer. The problem (like I mentioned earlier) is that a human is trying to manually manage the lifetimes and access of millions of objects along millions of code paths with a language that enforces no rules on any of these things. The solution is something like Rust.

[@sheenismhaellim2215]

I'm actually really impressed how people are able to find these exploits and how you actually show the exploit. I wish I had a fraction of brain power required to be able in that field. Good stuff!!

[@JournalRahmen]

I've seen it all mailicous css

[@neoqwerty]

honestly I was expecting someone's css repo got hacked and is serving bad code somehow, I did NOT have "css animations use arbitrary code execution" on my bingo card.

[@MacDKB]

"They're deleting the dogs, they're deleting the cats. Delete the cat, delete delete the cats..." /oblig 😏

[@dogamongstmen]

The styles that came in, they’re freeing the dogs, they’re freeing the cats…

[@the-answer-is-42]

@dogamongstmen ... And now they make the dogs think they are cats!

[@109Rage]

Hey, so, after a bit of looking around, it SOUNDS like this exploit is related to the "animation-timeline" CSS property, which is new and experimental. But also, it's not enabled in Firefox by default, so even if the potential damage of this exploit is high, it looks like only a small amount of users would have been affected, given you would have to go into your about:config, look for the right flag, and enable it manually.

[@Merssedes]

This creates question: is it still vulnerable if the feature is disabled?

[@Dino-te5rt]

@@Merssedes No it shouldn't be vulnerable if disabled. the code isn't being run so you can't access any of the vulnerabilities it creates. if you somehow can then that a whole other issue.

[@Merssedes]

@@Dino-te5rt If so, why 9.8 severity?

[@109Rage]

@@Merssedes Probably because the exploit itself still gives the attacker a lot of potential control of your system, if it succeeds. The fact that only a (very small) subset of users are actually vulnerable doesn't factor in to the rating (as much) compared to the potential damage an attacker can actually cause to those vulnerable.

[@borstenpinsel]

​@@Merssedesbecause it's a 0day and if not patched will eventually affect everyone? Like, unless they have insights into the development and know about the release candidats, one must assume this feature could be turned on by default with the next minor update

[@vladimir0rus]

8:03 "Would Rust have fixed this?" - yes, as well as C++ with smart pointers.

[@izd4]

can't believe we're still talking about C++ like it's a real language and not tech debt

[@vladimir0rus]

@@izd4 there is actually no need in rust because modern C++ is good enough for any practical use, more powerful and easier to learn.

[@izd4]

@@vladimir0rus first time I've heard that C++ is easier than anything to learn. The language can't even get a (good) `cargo` equivalent

[@vladimir0rus]

@izd4 there are a lot of C++ programmers out there, of course it would be easier for them to learn modern safe C++ than Rust. And tons of C++ code will be easier to redactor than rewrite.

[@God-i2]

No! Look how they have massacred my little fox😢

[@IronCandyNotes]

enter Michael the browser that ll fix things... permanently

[@kingjames4886]

Q: when is a cat a dog? A: when you free the dog then frank and randy point at each other

[@MichaelWaisJr]

I’m a dog!

[@MichaelWaisJr]

Now I’m a cat!

[@MichaelWaisJr]

Now I’m a merman!

[@nicholas_obert]

Are you assuming that the allocator returns pointers to the exact same memory location? Looking at the code, I don't see any other way for randy and frank to overlap.

[@entcraft44]

That is not an unlikely assumption. Many attacks of this nature are somewhat probabilistic in nature, only working sometimes and on some systems.

[@ImmiXIncredible]

@@entcraft44 but how does rust prevent this? If my reference goes out of scope it gets invalidated, but if a new, uncorrelated heap allocation references the same memory as the already invalidated one, how is the borrow checker going to notice? That's all runtime dependent

[@rodneynsubuga6275]

That's why I say rust is theoretically strong but not practically there are some bugs that are so creative

[@Gabriel-mw5ro]

@@ImmiXIncredible rust won't allow you to drop/free something inside a loop because it could be used in the next iteration. the fact that the second allocation potentially takes the same spot in memory becomes irrelevant

[@entcraft44]

@@ImmiXIncredible Rust will not allow you to access dropped values. So the old pointer is invalid and can't be used, in particular it can't access the new allocation. Rust also doesn't allow access to objects that may be uninitialized, which prevents the pointer to the new allocation from learning about the old allocation.

[@lolbat.]

Everything getting attacked these days

[@MichaelWaisJr]

Oh yeah! Ellen Degeneres is getting attacked. Trump’s getting attacked. Kamala’s getting attacked. Even McDonalds is getting attacked! Even pancakes are getting attacked!

[@MichaelWaisJr]

The sun and the solar system are getting attacked! Coming soon to a demonstration near you.

[@leshommesdupilly]

They made css turing complete 💀

[@jovetj]

*spurning complete

[@kamilziemian995]

"Todays video is sponsor by ME!" I love this part 😀. I will join Low Level Academy this year, but I have too much expenses this month.

[@RottenMuLoT]

And I just very recently quit Chrome to Firefox 😅 but eh, I like the way you put all this into perspective. Great job!

[@erikkonstas]

The reason being uBO right? 😂 Yeah I'm also planning on heading that direction soon, the moment it stops working that is...

[@dondattler7085]

Thanks for confirming my suspicions, I don't have IPv6 enabled, never have. I always suspected some weaknesses to exploit.

[@THE16THPHANTOM]

fireship guy explained this better. i mean in much simpler way that a non c++ user can understand. basically i came down to this as i understood it, its like deleting file from disk but all the OS does is say the space the file was occupying is free to be used and as long as the computer hasn't overwritten the space you can still read or recover that file. and solution is to secure erase which overwrites the free space with random data. and the solution to the fire fox problem was to set the pointer = null after you free it. something like that.

[@secretzpt176]

LL's explanation was very clear...

[@omarassadi2455]

Supposedly it required JavaScript to be enabled in order to actually pull off the exploit (I believe the AnimationTimeline API), so it seems less like a "CSS exploit" to me, and instead more of yet another reason to disable JS.

[@neoqwerty]

Yeah, I work with CSS animations (that + embedded SVGs can do some cool things, honestly) and I can definitely confirm that there ain't no "struct" and "printf" in CSS animation stuff. That sounds like Javascript or MAYBE a web API thing (I haven't looked deeply into HTML5 stuff so I can only say that I've seen these instructions on JS, not in CSS).

[@shrootskyi815]

@@neoqwerty the "struct" and "printf" stuff is Low Level's example of what a use-after-free vulnerability looks like in a C program. It's not an example of how you would use CSS to perform this exploit. The real UAF vulnerability would be in the part of Firefox's browser engine code that handles CSS animations, which is written in C++. Low Level is demonstrating in C though, because it's simpler for most people to understand. As a side note, the details of how to perform the exploit haven't been made public yet.

[@wasd____]

@@neoqwerty There IS stuff like that in CSS, it's just that it's in the source code of the parser, not in the part you use as a web developer.

[@Deadlious]

I've got no idea why I was left with the impression that Mozilla re-wrote Firefox engine in Rust...

[@adhi_atma]

Man.. my college now teaching python for basic programming. Back then i learn this dreaded C pointer as basic programming .

[@JLT9150]

Colleges teaching python is a disaster, not progress. Kids must be allowed to learn challenging things so they know how to grow as adults.

[@JJFX-]

I wouldn't have as much of an issue with that in some community college courses since it's less intimidating and may catch more people's interest but outside of that you have to focus on the fundamentals.

[@erikkonstas]

At my university they still have C as the introductory (and most-used overall) language. To think that in other universities students have zero clue about the resources they're using is atrocious at the very least...

[@JLT9150]

@@JJFX- computing is not a religion, if people have such a mindset there is plenty of exposure to tech to catch on to it

[@JLT9150]

@@erikkonstas recently I tried wasmer and installed a one line python demo, it took 600MB

[@Sv443_]

8:20 Mozilla is already slowly replacing the codebase with Rust, it's just that refactors like that take ages considering the millions of total lines of code.

[@I_Am_Your_Problem]

Millions?

[@kunka592]

@@I_Am_Your_Problem 31 million lines of code for Firefox.

[@Sv443_]

@@I_Am_Your_Problem yes, about 11 million loc (C and C++) according to openhub, while rust is currently at 3.5 mil

[@MrHerbalite]

The question soon might be how is Mozilla being funded to allow them to do that. I owe a few books on common errors made in C/C++ programming. There are much easier and safer ways than rewriting things into another language. That process has it's own gotcha as well. Also besides the programming there is the testing. If good tests are being developed they should even find out such issues. From my perspective it seems that is the only way to avoid such bugs at all. No offense to any language, but never trust a developer or a language, the end product needs to be without these security issues, that's what really matters.

[@Sv443_]

@@MrHerbalite from what I heard use-after-free is notoriously difficult to detect, so even if you have static code analysis and unit tests it can easily slip through the cracks.

[@tendamolesta]

Firefox was supposed to be substituted by "Servo", a rust based browser. The reasons were exactly what you pointed at

[@perplexedon9834]

Me: but LL, would Rust have fixed this? LL: Rust would have fixed this

[@kamalkumarmukiri4267]

Tried to simulate same scenario using Rust: Result: Compilation: Successful Runtime: Process panics with below comment: called `Option::unwrap()` on a `None` value Answer: Yes, rust protects from leaking info. Crash is better than leaking information.

[@perplexedon9834]

@@kamalkumarmukiri4267 if you are unwrapping a value that could possibly be "None", then your code is a draft. Unwrap is for fast prototyping, and situations where the programmer has reasoned and verified that a "None" value is impossible.

[@MEZHGANO]

This is how you forced to update

[@F_Around_and_find_out]

Rust is a great language for applications. Programmers can focus on designing backends and frontends i.e an app, while stops thinking about memory altogether because it is almost guaranteed to be properly handled. Rust got your back on anything memory.

[@bitesizedkiran]

I love when KZbinrs record their browsers they all turn off Adblock

[@erikkonstas]

Eh, actually this might be to appease KZbin itself... can't be herding the crowd to salvation from the ad barrages...

[@the-answer-is-42]

This reminded me to update all my devices. Should be safe now (I updated the ones I use regularly days ago, today I just made sure all were updated). And it was good to see that example, I didn't know what the type confusion thing was before. Thanks.

[@fibonacho]

I updated the example at 5:38 Line 39: } else if (!strcmp(buff, "eatthedog")) { Line 41: } else if (!strcmp(buff, "eatthecat")) {

[@transire3450]

Your example of "use after free" is also rare scenario where unstable ABI is positive thing :)

[@havocthehobbit]

"your would Rust have fixed this?" , segment was what I was thinking about throughout most the video running a thaught simulation in my head . One of the things I was hoping is that the borrow checker would scold you if youre not using unsafe mode/code. then I googled how much Rust does FF use , and saw its currently less then 20% . Digital Reality gets it's kicks off irony.

[@JamesHardy-yi1ph]

You should always update ASAP when there's a new update. But it really pays off to also implement MAC control for your applications as well. I'm not sure what the Windows and Apple equivalents are, but for Linux always make yourself a comprehensive apparmor profile for your high risk applications. That would definitely include whatever browser you use. Apparmor is no guarantee mind you, but it has been known to stop zero days from executing properly.

[@glasstuna]

KZbin ads are specifically designed to interrupt the most important sections of a lesson. Their purpose is to overwrite the previous interest in a certain subject and inject whatever product they are trying to sell. There is a big problem with this. Some people are immune, they recognize the interruption, they recognize the source. They notice...

[@maximumg99]

I liked the code example! I was familiar with the idea of use after frees, but seeing that it's just type confusion makes sense

[@rodneynsubuga6275]

Not really just the example he used;

[@erikkonstas]

It's not always type punning stuff, UAF is basically any sort of reference to memory that happens after it's been freed (and allocated again subsequently) but assumes it's not yet been freed.

[@maximumg99]

@@erikkonstas Yeah sorry my comment wasn't really clear, I was referring specifically to this use after free in the second part of the second sentence

[@109Rage]

Firefox's CSS parsing & matching code is actually in Rust. It was one of the two things that Mozilla extracted from Servo before they abandoned it, the other one being the compositor. Guess this bug is in some later part of the CSS rendering pipeline that's still in C++.

[@balsalmalberto8086]

Gotta increase that CEO pay.. priorities man.

[@omarassadi2455]

Supposedly it required JavaScript to be enabled in order to actually pull off the exploit (I believe the AnimationTimeline API), so it seems less like a "CSS exploit" to me, and instead more of yet another reason to disable JS.

[@109Rage]

@@omarassadi2455 It also requires you to enable a flag in about:config, because the exploited feature is actually disabled by default on FireFox.

[@neoqwerty]

@@omarassadi2455 It's always Javascript, I swear to god. Also, yeah, this... As someone who struggles with JavaScript but nails it on CSS, I can 100% tell you that we do NOT have anything like "struct" and "void" in css animations alone. That ain't CSS.

[@balsalmalberto8086]

@@omarassadi2455 The devil is in the details. I love that even tech channels just spread FUD. I guess you gotta RTFM everywhere you go.

[@mintoo2cool]

Them Hackers be Stylin and Profilin with CSS Wooooo!

[@cruz1ale]

When you make a video about a vulnerability, you could put the CVE identifier in your video description

[@erikkonstas]

If that is even public as of yet... sometimes there is a bunch of CVEs that just say "RESERVED", with not a single word about what exactly has reserved them.

[@vladislavkaras491]

Thanks for the news and even the explanation!

[@robertthompson7242]

so, while you're working on this, FF has updated again. Like the second time in a couple days. 131 .0 .3 is now current.

[@CaptMirage]

yay finally low level got to it

[@codeguy7309]

The news finally reached Australia 🔥🔥🔥

[@haystackdmilith]

Great, that you share this knowledge with the world. It needs it :)

[@silentninjabee2985]

0.57s Microsoft mentioned. Usual suspects 😅

[@This_Guy-]

once rust gets to level of c and c++ in future, people will say rust is not a safe language and suggest some other language that will be invented . This process continues no language is bad .

[@spark_thecat]

funny thing, is by the time it was found and reported it was already patched x) I love opensource exploits never last long. just keep your install updated :3

[@BlackHermit]

The 0-day of the Law, at long last!

[@Valerius123]

I don't think any language will solve the fundamental human problem that people are always in a hurry. We've got deadlines. We've got limited lifespans. Whatever. So we don't take the time to read the specification of the functions we are calling enough and we call them in ways they shouldn't be.

[@implode3]

Interesting, good to get a heads up on this stuff.

[@numbr6]

Another good reason Mozilla is rewriting good parts of Firefox in Rust.

[@cdmh2010]

Use calloc instead of malloc and the object confusion goes away, reducing it to a plain null pointer exception. A bad crash instead of a security hole.

[@WoolleyWoolf]

"Another day, another vulnerability" - haha best quote of the year so true.

[@kevinshumaker3753]

32 minutes after release of the video, I'm already sitting at FF 131.0.3...

[@QuickishFM]

rolling release gang rise up

[@kevinshumaker3753]

@@privacyvalued4134 So was it fixed in 131.0.2, 131.0.3, or still isn't patched?

[@erikkonstas]

@@privacyvalued4134 I mean it's not exactly outdated since a lot of people don't update as often as they should, but also the fact that a report about a literal zero-day is outdated sounds like a perfectly good thing to me. Imagine if instead it was "and y'all are doomed until the Mercy of Mozilla blesses you"...

[@laurenzkeller4971]

Hi, I really enjoyed your video. Is it possible to provide a text file that contains the code snippets you use in your video? I would like to try it out myself. Regarding low level academy, is it a course mainly for beginners or will there also be advanced courses?

[@paxdriver]

25 years handwriting javascript, css and html and I hear this explanation of pointers somehow being controlled of other memory... And still, despite hardware background and trying repeatedly, understanding dereferenced pointers and how a bug means a malicious script can be planted then addressed and then called is like "yada yada yada" every time its explained as if to a laymen it seems just as hard to understand planting an rce as it is causing a memory overflow and knowing precisely what to out in precisely that address without rebooting or or having anything else in the system not get in the way or detect the anomaly. It's still baffling to me, even though you explain it so well the simple example is a wall of code that references all over the place before crossing over aaaand "yada yada yada" lol I'm sure that's probably the simplest example, but a quick 20 seconds on how reversing the order of void and I'd assignment makes any difference would be mad helpful to follow, presuming you're going into this much detail to help people follow rather than only those who don't need the example to follow because they already do ctf competitions.

[@erikkonstas]

See, the problem here is that C itself obviously doesn't provide a well-defined way to do a UAF on purpose (and it doesn't intend to, it's not something you want to do); the fact that it happens with this code is lucky, actually, as this is "undefined behavior" so literally anything else could've happened instead.

[@wesleyvalentijn6441]

The order doesn't really have anything to do with it, it's mostly the size that is relevant! Lets say the allocator has a block of 8 bytes to use, the memory initially looks like used:[] free:[00000000], when allocating 2 bytes, we now have used:[00] free:[000000], but when freeing that block again it's not just added back to the bigger pool, it stays at the smaller size so used:[] free:[00],[000000]. This way when another allocation for 2 bytes comes along it doesn't have to split any blocks, and also doesn't have to recalculate block sizes when deallocations happen(because SPEEEEEEED).

[@CrispyGFX]

The one single hair curl hanging down is very cute bby

[@michaelsegel8758]

Look, there are millions of lines of COBOL, as there are millions of lines of C/C++ code out in the wild. Rust comes a long... doesn't mean refactoring everything overnight. And still w Rust... you will eventually end up w calls to unsafe code. As to the issue.. as you point out... you're not nulling out the pointer when you're done with it. Meaning you can write safe C/C++ code if you know what you're doing. The problem... maybe 10% of those who wrote C code actually knew what they were doing. This is true for many languages, except that when you look at C/C++ and now Rust... most of that code was not really at a low enough level to be a security threat. Another large if not larger problem... A lot of the C code that was written was done to a specific spec. Over time the code has morphed w the spec changing and I can guarantee you that those updating the code in many cases didn't really think about potential security threats due to the modifications.

[@Baile_an_Locha]

Fully agreed that Rust would have fixed it. But a C++ team using a modern coding style that prohibits use of raw pointers would also have avoided the issue. In other words: - randy would be of type std::unique_ptr - “newcat” would do: randy.reset(new cat{ .id = ???, .fun_ptr = ??? }); - “deletecat” would do: randy.reset(); I do appreciate the distinction though. In Rust the safety is inherent to the language. In Modern C++ the safety is largely in the Standard Library, and it is necessary for tools and/or human reviewers to ensure that it is used. But I have observed a strange irony more than once at different employers, which is that the same engineers who will push back strongly C++ coding style rules requiring RAII, const correctness, etc. are the very same engineers who argue in favour of Rust to improve safety. Try maybe using the tools already at your disposal guys!

[@MrHerbalite]

Additionally: How hard is to tweak a compiler to just disallow keywords like malloc, etc...

[@Baile_an_Locha]

@@MrHerbalite As part of my job, I often have to get a quick feel for the quality of a codebase. If looking at a code that purports to be “Modern C++”, one of the first things I do is count all occurrences of “malloc”, “calloc”, “free”, “new”, and “delete”. If it’s using COM, I’ll also search for “->Release”. As a general rule, if any of these are high, it ain’t Modern C++!

[@erikkonstas]

No no, they have a point in the sense that C++ itself is becoming more and more a steaming pile of hot garbage (you really don't want to know the level of maturity within ISO Working Group 21...).

[@vincent_sz]

Years ago I heard a talk about a alternative memory allocator implementation for chromium which just made this type of attack impossible by using the whole 64bit address space and map the virtual addresses of new allocations to ever incrementing addresses. A use after free would be an access to an unmapped address and the program is terminated.

[@erikkonstas]

That sounds like some sort of arena, except that instead of a "catalog" it just has a single offset from the starting address.

[@agooodolecoder]

A one week old 0 day..🎉

[@frydac]

I'm guessing the hackers could have found this vulnerability by fuzz testing, and I think fuzz testing could have prevented the exploit. I had to watch 2x to understand apparently, what I missed was the assumption that when you malloc, then free, then malloc again (with the same size), you get the same region of memory again for the second malloc, and that is why randy and frank pointers contain the same memory address. You seemed to assume this would be obvious, but even as an experienced C and C++ dev, I missed that the first time. I think it would have been more easy to follow if there was a box and line drawing, or something, accompanying the explanation. But still, good example, this was like an aha moment, thanks!

[@erikkonstas]

This is actually not guaranteed behavior, the C code is perfect UB.

[@sammmba]

what is the keyboard you're using? sounds so clean

[@cranjismcbasketball8113]

Deleting the dog, deleting the cat. Delete the cat, delete delete the cat!

[@rosyidharyadi7871]

Sorry stupid question: I often read in security news - this and that bug has been exploited in the wild, how do they know that?

[@w1z4rd9]

Probably cuz it's reported from a Researcher on a Security Company that monitors. IDK

[@user-zz6fk8bc8u]

You know that it's "exploited in the wild" if you see websites (or often ads for that matter) that use this exploit.

[@erikkonstas]

They do have evidence, but obviously they can't reveal it before the perpetrator is convicted by a judge, as it would constitute defamation.

[@witchtheer3450]

another day , another missed oportunity to say " Another day , another zero day"

[@lambdacalculus3385]

the code you giving as an example is not C++. yes, other than some exceptions, C++ can interact with C without a problem. but your example code is pure C, no STL usage, pure POSIX calls, function pointer in struct, instead of using lambdas or std::function (it might be slow sometimes but with usage of concepts, easy to store functions since they are invokable, just simple template and it's good). yes C++ might be dangerous to write good quality and safe code for beginners, Rust is a good language too. also there is C++ hardened and Safe C++ proposal submitted by Sean Baxter (creator of Circle compiler), I hope a subset of C++ being full memory safe that can interop with general C++ code via some unsafe flags. There is more than trillion lines of code written in C++ and they won't phase out for decades.

[@erikkonstas]

I'm pretty sure he is well aware that the code is C, what with him very explicitly referring to it as "C"...

[@xjjfjfdjdh9993bbhhhh5hjjjjd]

Thanks for mentioning Rust!

[@Sp4kman]

I love the rust plug in every video lmfao

[@Relkond]

Magic numbers could also prevent this to an extent - give each type a number, when referencing the type check that number - is it the wrong number? You're looking at something that's not your type - raise an error. While not proof against exploits, making the magic numbers randomly chosen at runtime would make exploiting this more difficult.

[@erikkonstas]

What if the type is the same but the ownership is different? Or that what used to point at the beginning now points at some middle which happens to spell out the same magic number?

[@Relkond]

@@erikkonstas magic numbers are not a universal solution. only snakeoil can claim that.

[@yonas6832]

i miss Low Levellearning

[@dantenotavailable]

I'll be interested to see what part 2 says about how the exploit is triggered but given that it seems like JS is involved i'm wondering if even a theoretically maximally Rust browser would still potentially be vulnerable.

[@find2hard]

The biggest case against rust is the rust community.

[@deep.space.12]

I've got two questions if someone would kindly answer: Why isn't the dangling pointer deleted (or set to null) after the memory is freed? Would this be spotted by linting? Why are C-styled pointers still in use, instead of modern C++ smart pointers like std::unique_ptr? Would this have been able to prevent the use-after-free? Thanks

[@vladimir0rus]

use-after-free perfectly detected by memory sanitizers/Valgring and even by static code analysis. smart pointers eliminate this problem of course.

[@defeqel6537]

I use C-style pointers still quite regularly for non-owning pointers, though it might be better to migrate to weak_ptr, but that also then requires two levels of indirection, and an atomic counter in case of the owning shared_ptr

[@fejimush]

Sounds like poorly written C ++ code. Likely using C++ as a better C. Had they used smart pointers instead of raw C pointers this wouldn’t be a problem. No Rust required.

[@cherubin7th]

If they were just perfect humans that never make mistakes this would never have happened of course.

[@fejimush]

@@cherubin7th it’s a certainty there’s no correlation between human perfection and Rust. There are very good reasons why no “safe” system level software language has toppled C/C++ over the past half century. 1) Bugs and vulnerabilities in “safe” languages become much harder to find. 2) Relying on the tool chain for safety becomes a single point of failure. e.g. Java’s JRE has been a spawning ground for exploitation. 3) Serious professional software engineers are typically not fans of nanny state languages. Many of the hardcore Linux kernel developers want nothing to do with Rust. There’s a hilarious presentation by K. Overstreet and a Rust evangelist to the kernel devs that can’t help but continuously piss them off. 4) Performance, performance, performance. e.g. No legit performance focused game studio would ever give up safety for performance. Rest assured Rust’s popularity will wain and find its niche as the shiny new toy effect wears off.

[@vladimir0rus]

@@cherubin7th Rust has "unsafe" if you don't know.

[@defeqel6537]

@@cherubin7th you hardly need to be perfect to use smart pointers

[@morejpeg]

Babe wake up, new vulnerability just dropped

[@autohmae]

And this is part why Mozilla created Rust. 🙂

[@Electrically-Electronic]

I can't afford low level academy as of now. But I will certainly check them out in the future when I get the time and money to invest in it.

[@4ohf]

I have a question: do browsers really *need* to be that complex? firefox is a few milion lines of code, is that all really necessary? is it just backwards compatibility stuff or is rendering webpages actually that big of a problem? I guess i'm asking if an alternate reality can exist where browsers are not so "bloated" and creating a new one from scratch isn't such a mess

[@defeqel6537]

JS spec alone is quite an undertaking, especially when considering security and performance

[@noweve-rg5rx]

Effected browsers is firefox tor browser, librewolf, zen-browser & more.

[@erikkonstas]

Congratulations, you are very clever...

[@jsaenzMusic]

I thought I remembered the ladybird project adopting C++ instead of rust but then realized it was Swift not C++. So....maybe A memory safe browser coming sometime before we die?😅

[@russellstyles5381]

I can think of several ways to reduce this vulnerability. Probably already done. Have free - the root code that users cannot change - zero that memory. If the memory is returned to the system - not a suballocate - insure that freed memory has zero permissions.

[@hebozhe]

Hey, some of us use Tor for web scraping -- totally above-board.

[@7Mirino]

Hi LLT! Any possibility of you adding regional pricing to your courses? In Brazil, the current cost is prohibitive (at least to me).

[@erikkonstas]

Not as easy as you think... dealing with currency conversions is its own b*tch, and trying to appease the people while still being profitable is often a dead end.

[@jsmith7038]

Nice sounding keyboard, what is it?

[@Veptis]

my hackernews doesn't look like this

[@allNicksAlreadyTaken]

I have trouble understanding how this can be reproduced with C++ v-tables. Why did you not create an example in C++?

[@WillWilson2068]

So THAT's where Catdog came from...

[@boscovallejo-nagera6073]

I remember reading about servo, the new web engine written in rust that Mozilla was working on. I wonder how it's going

[@foobarf8766]

Another reason to use official browsers and not "privacy" ones that turn this shot on by default, like why use brave when chromium is where the patches go first.

[@I_Am_Your_Problem]

Official browsers. I found the troll.

[@erikkonstas]

There are reasons why, but *this is not one of them...*

[@MacDKB]

So, is the Linux version affected, or was the Microsoft reference a misspeak? Also, I WAS going to ask whether the vulnerability would have happened if Firefox were coded exclusively in Rust. All we have to do now is rewrite the browser in Rust. Let's get to it, guys! 😂 (On a more semi-serious note, maybe AI could eventually do the rewrite...)

[@entcraft44]

It was a misspeak (LL confirmed it in another comment). Also, it wouldn't make sense for rendering code to be different on different operating systems I think.

[@kuhluhOG]

Didn't Firefox switch out their *CSS engine* with the one from servo before Mozilla pulled their funding from it?

[@vaisakh_km]

I had the fantasy of AI rewriting everything in rust..., but i don't think there is enough code base in rust for AI to learn..

[@entcraft44]

I have heard that new studies show that AI increases the amount of bugs in code significantly while not increasing productivity, at least for experienced developers. That doesn't sound good. But then again, it might not be true and/or change in the future and/or be different for code translation instead of generation.

[@109Rage]

@@kuhluhOG Only the CSS parsing & matching engine came from Servo. This means the part that turns CSS into a tree of style rules, and then matching those rules against HTML/DOM elements. The Rust code will tell the browser that a DOM element has a certain animation associated with it, but the code that actually processes and runs the animation is probably still in C++.

[@georgeindestructible]

One more reason to use ad-blockers, less execution of java script-based code, less chances of stumbling at such things, right?