Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss
7 out of 10 Microsoft Windows patches address memory issues from C/C++ code
34 views
Skip to first unread message
Rick C. Hodgin
Feb 18, 2019, 10:13:30 AM2/18/19
to
https://www.fudzilla.com/news/pc-hardware/48123-more-than-70-percent-of-microsoft-patches-are-for-memory-problems
"More than 70 percent of Microsoft patches are for memory safety bugs.
"Speaking to the assembled throngs at an Israel Security conference,
a Microsoft engineer Matt Miller said that memory safety bugs happen
when software, accidentally or intentionally, accesses system memory
in a way that exceeds its allocated size and memory addresses.
"He said that over the the last 12 years, around 70 percent of all
Microsoft patches were fixes for memory safety bugs.
"The reason for this high percentage is because Windows has been writ-
ten mostly in C and C++, two 'memory-unsafe' programming languages...
"One slip-up in the developers' memory management code can lead to a
slew of memory safety errors that attackers can exploit with dangerous
and intrusive consequences --such as remote code execution or elevation
of privilege flaws..."
--
Rick C. Hodgin
"More than 70 percent of Microsoft patches are for memory safety bugs.
"Speaking to the assembled throngs at an Israel Security conference,
a Microsoft engineer Matt Miller said that memory safety bugs happen
when software, accidentally or intentionally, accesses system memory
in a way that exceeds its allocated size and memory addresses.
"He said that over the the last 12 years, around 70 percent of all
Microsoft patches were fixes for memory safety bugs.
"The reason for this high percentage is because Windows has been writ-
ten mostly in C and C++, two 'memory-unsafe' programming languages...
"One slip-up in the developers' memory management code can lead to a
slew of memory safety errors that attackers can exploit with dangerous
and intrusive consequences --such as remote code execution or elevation
of privilege flaws..."
--
Rick C. Hodgin
Mr. Man-wai Chang
Feb 18, 2019, 11:29:03 AM2/18/19
to
On 2/18/2019 11:15 PM, Rick C. Hodgin wrote:
>
> "He said that over the the last 12 years, around 70 percent of all
> Microsoft patches were fixes for memory safety bugs.
It's not the fault of C nor C compilers. It's the programmers
>
> "He said that over the the last 12 years, around 70 percent of all
> Microsoft patches were fixes for memory safety bugs.
deliberately not auditing their memory use.
--
@~@ Remain silent! Drink, Blink, Stretch! Live long and prosper!!
/ v \ Simplicity is Beauty!
/( _ )\ May the Force and farces be with you!
^ ^ (x86_64 Ubuntu 9.10) Linux 2.6.39.3
¤£É¶U! ¤£¶BÄF! ¤£½ä¿ú! ¤£´©¥æ! ¤£¥´¥æ! ¤£¥´§T! ¤£¦Û±þ! ¤£¨D¯«!
½Ð¦Ò¼{ºî´© (CSSA):
http://www.swd.gov.hk/tc/index/site_pubsvc/page_socsecu/sub_addressesa
Ben Bacarisse
Feb 18, 2019, 1:34:44 PM2/18/19
to
"Rick C. Hodgin" <rick.c...@gmail.com> writes:
> https://www.fudzilla.com/news/pc-hardware/48123-more-than-70-percent-of-microsoft-patches-are-for-memory-problems
>
> "More than 70 percent of Microsoft patches are for memory safety bugs.
>
> "Speaking to the assembled throngs at an Israel Security conference,
> a Microsoft engineer Matt Miller said that memory safety bugs happen
> when software, accidentally or intentionally, accesses system memory
> in a way that exceeds its allocated size and memory addresses.
>
> "He said that over the the last 12 years, around 70 percent of all
> Microsoft patches were fixes for memory safety bugs.
I wonder if any explanation was offered as to why so many of these bugs
> https://www.fudzilla.com/news/pc-hardware/48123-more-than-70-percent-of-microsoft-patches-are-for-memory-problems
>
> "More than 70 percent of Microsoft patches are for memory safety bugs.
>
> "Speaking to the assembled throngs at an Israel Security conference,
> a Microsoft engineer Matt Miller said that memory safety bugs happen
> when software, accidentally or intentionally, accesses system memory
> in a way that exceeds its allocated size and memory addresses.
>
> "He said that over the the last 12 years, around 70 percent of all
> Microsoft patches were fixes for memory safety bugs.
were found by people who probably had no access to the source code
rather than by people doing code reviews and testing.
If these are, in fact, the result of internal review, then the timing
just needs to be altered.
If these are being found internally before release, then it's bug fixing
and not really headline news.
Not that that lets C off the hook, but it does look like an exercise in
looking everywhere but on your own doorstep. (That's from the limited
quotes -- there's no link to what was actually said.)
--
Ben.
0 new messages