Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Reconsider usage of UBSAN #113

Closed
jcharaoui opened this issue Feb 22, 2023 · 3 comments
Closed

Reconsider usage of UBSAN #113

jcharaoui opened this issue Feb 22, 2023 · 3 comments

Comments

@jcharaoui
Copy link
Collaborator

The Debian security team believes the usage of UBSAN in HTTPDirFS may bring more harm than good:

This is a bad idea not only due to slower execution,
but might even introduce vulnerabilities:
https://www.openwall.com/lists/oss-security/2016/02/17/9

While there are safe usages of ubsan, httpdirfs being the
only package in the archive that uses ubsan but not asan
is something that sounds wrong and underreviewed.

Original bug report: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1031744
@jcharaoui
Copy link
Collaborator Author

Also making a note that since the bug has been reported with RC (release-critical) severity, unless we fix it in Debian, it will be removed from the upcoming stable release (bookworm).

@fangfufu
Copy link
Owner

fangfufu commented Feb 23, 2023 •
edited
Loading

Yeh, I don't think we actually need UBSAN. I just thought it might be a good idea when I added in. I didn't know it could introduce security vulnerability. I am just going to remove it for now, unless Adrian suggests that I should add ASAN alongside UBSAN, rather than just remove UBSAN.

fangfufu added a commit that referenced this issue Feb 23, 2023
@fangfufu
Remove the usage of UBSAN
fe45afc 
Address issue #113. Use of UBSAN in runtime could introduce
vulnerabilities.

Original bug report:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1031744

Reference:
https://www.openwall.com/lists/oss-security/2016/02/17/9
@jcharaoui
Copy link
Collaborator Author

Closing as fixed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@jcharaoui @fangfufu