StalkR

https://blog.stalkr.net/2022/01/universal-go-exploit-using-data-races.html

This example hardcodes the payload, but (unless I've badly misunderstood how the exploit works) that's not necessary, it could instead be input from the network (and you wouldn't have to pass that input to any APIs that are marked unsafe). The payload is just hardcoded so that the example could be reproduced on the public Go Playground, which sandboxes the code it runs and so can't accept network input.

Note that what tptacek is asking for is more stringent than this; he wants a proof-of-concept exploitation of a memory safety vulnerability caused by the data-race loopholes in the Go memory model, in a real program that someone is running in production. I do think it's interesting that nobody has demonstrated that yet, but I'm not sure what it tells us about how sure we can be that those vulnerabilities don't exist.

>> 70% of security defects in memory-safe languages are probably also memory safety problems.

> That doesn't make any sense at all

I'm sure it's not true—70% is way too high—but the real number isn't 0% as you might expect.

In particular, (most? all?) non-Rust languages that claim or appear to be memory-safe can have data races. In Go for example, those can be exploitable. [1]

And Rust is memory-safe...in safe code, with a bug-free compiler. Real programs have some unsafe code in their transitive dependencies and are compiled with the real, buggy compiler. [2] The percentage of security bugs in Rust code that are due to memory safety problems is more than 0%.

[1] https://blog.stalkr.net/2015/04/golang-data-races-to-break-memory-safety.html

[2] https://github.com/rust-lang/rust/issues?q=is%3Aopen+is%3Aissue+label%3A%22I-unsound+%F0%9F%92%A5%22

I've seen Qt Creator segfault due to the CMake plugin doing some strange QStringList operations on an inconsistent "implicitly shared" collection, that I guess broke due to multithreading (though I'm not sure exactly what happened). In RSS Guard, performing two different "background sync" operations causes two different threads to touch the same list collections, producing a segfault. (These are due to multiple threads touching the same collection/pointers; racing on primitive values is probably less directly going to lead to memory unsafety.)

Apparently in Golang, you can achieve memory unsafety through data races: https://blog.stalkr.net/2015/04/golang-data-races-to-break-memory-safety.html (though I'm not sure if a workaround has been added to prevent memory unsafety).

Very interesting, thank you!

Looking at the attack vector (https://blog.stalkr.net/2019/11/the-gomium-browser-google-ctf-2019.html), this is a pretty tightly constrained circumstance where you are permitting an attacker to execute unknown Golang code within the context of your process. (perhaps like the Go Playground, if that's not starting a new process for each user.)

I don't personally think that's really that applicable to regular golang users, unless they're trying to sandbox Golang code somehow within the language itself. (And if you are allowing untrusted code, then it's basically game over anyway).

But it's still interesting and I added a note to my comment above about your point.

What? Sorry, that doesn't make the least amount of sense.

If you have a VM your code is DATA! You can have say format string bugs in managed languages too, see for example: http://blog.stalkr.net/2013/06/golang-heap-corruption-during-garbage.html

I'm sorry, but you're agrument here is plain bullshit.

Using your logic the whole kernel/browsers etc should be written in a managed language.

A browser is basically a VM for webpages though. I'd bet that chrome/firefox/IE have more severe vulnerabilities than openssl per time though.

I just... You can't argue with bullshit sorry.

Your might get less buffer overruns okay, but is it more secure in the end without any doubt?

I doubt it.

To be clear, yes. The issue is with how Go's "interface{}"s (and some other types - like slices, etc) work - it's two pointers that can't be written to atomically, which means you can get into a situation where your objects are invalid.

https://blog.stalkr.net/2015/04/golang-data-races-to-break-memory-safety.html

Here you can find a POC.

You could argue that this is contrived, but it's also not going to be fixed. This is in contrast to Rust, where there may be implementation flaws leading to unsafety in safe code, but the language retains the right to fix those, even if it breaks code.

Still, I think there's really no question that Go is a major step up over C and C++.