IIRC, all the recent sudo vulns are logic errors, not memory safety. I mean, rew...

fanf2 · 2023-11-06T20:30:38 1699302638

2021: https://nvd.nist.gov/vuln/detail/CVE-2021-3156

2019: https://nvd.nist.gov/vuln/detail/CVE-2019-18634

badrabbit · 2023-11-07T08:00:57 1699344057

Fair point with the second one but for the first off by one is a logic error still?

Measter · 2023-11-07T11:39:01 1699357141

It was a logic error... that led to a memory safety error, which resulted in a privilege escalation vulnerability.

Just because the source is a logic error doesn't mean the end result can't be bad when combined with a lack of memory safety.

latexr · 2023-11-06T14:43:39 1699281819

> let's not pretend that there couldn't be some new bug introduced due to a misunderstanding of how something works or just a plain old mistake.

Is anyone doing that? I see a lot of claims of memory safety, but as far as I can see the project isn’t saying other types of bugs are for sure eliminated.

badrabbit · 2023-11-06T19:04:29 1699297469

That's fair and i support that but it does not address historical bug patterns that may be a design issue.

alpaca128 · 2023-11-06T13:55:19 1699278919

In the same way a new memory bug could be introduced to the original sudo. Shrinking the attack surface with static checks seems like a better deal in the long run.