Linux Bug Gets Squashed Two Years After Being Introduced

Image: iStock

The cycle in which ideas turn into software is getting shorter and shorter. By and large, this is a good thing as new functions are delivered to users faster than ever before. But one of the consequences is software bugs are introduced and sometimes missed. I suspect part of the reason is testing cycles are being squeezed. This is part of the root cause, I think, as to why a two year old bug was introduced into Linux.

Researcher Chris Coulson found the bug which can allow a malicious actor to write to a system using a specifically crafted TCP payload which exploits the flaw in systemd.

He traced the flaw back to a specific developer.

According to a report at ITWire, patches for Ubuntu have been issued while Debian may still be vulnerable. Red Hat says Red Hat Enterprise Linux 7 is not affected.

It's a good thing this was detected and fixed. But I remain concerned at how these flaws get introduced and committed to public codebases. I get that software is complex and that testing is challenging.

Is there a way to solve this challenge? Does the way we create software need to change? Or are we stuck with these sorts of issues?

Comments

lightyear @lightyear

Jul 5, 2017, 10:27am
You can take the philosophical angle:

We're stuck with them in just the way we're stuck with doors and windows in our homes. It's always a trade-off between accessibility and security. We can have perfectly secure software, but its utility would be exactly zero. Every time we add the ability to interact with the software, we add the potential for that to be exploited. The locks gets better, the windows get tougher, but break-ins aren't going away.

Or you can take the technical angle:

This class of bug (buffer overrun) is permitted by the language. Other languages don't allow them. We could require everything be written in Ada or something, but just like static analysis or language subsets, it doesn't solve everything.

But at the end of the day, many people have thought about this problem very deeply for a long time. There are "solutions" but as yet, there is no solution.
Permalink

1