The Ubuntu 25.10 transition to using some Rust system utilities continues proving quite rocky. Beyond some early performance issues with Rust Coreutils, breakage for some executables, and broken unattended upgrades due to a Rust Coreutils bug, it’s also sudo-rs now causing Ubuntu developers some headaches. There are two moderate security issues affecting sudo-rs, the Rust version of sudo being used by Ubuntu 25.10.

  • just_another_person@lemmy.world
    58·
    12 hours ago

    Which batch of you turds was in here all up in my stuff last week when I said Rust projects have security vulnerabilities all the time just as any other and you all were arguing like “nuh-uh cuz Rust”?

    Step up.

    • arcterus@piefed.blahaj.zoneEnglish
      10·
      5 hours ago

      Weren’t you the dude posting completely irrelevant articles? As I said before, no one reasonable thinks Rust programs won’t have bugs. Rust helps prevent a specific class of vulnerabilities. The rest is, as per usual, up to the programmer to avoid.

      EDIT: I browsed your comments to verify. You were indeed the person posting the irrelevant articles about malware written in Rust being used to exploit other programs and using it to claim that software written in Rust was vulnerable.

    • entwine@programming.dev
      40·
      11 hours ago

      Everyone knows that memory safety isn’t the only source of security vulnerabilities (unless you’re bickering about programming languages on the internet, in which case 100% of security vulnerabilities are related to memory safety)

      Rust users are one of Rust’s biggest weaknesses.

    • MTK@lemmy.world
      25·
      10 hours ago

      The Rust hype is funny because it is completely based on the fact that a leading cause of security vulnerabilities for all of these mature and secure projects is memory bugs, which is very true, but it completely fails to see that this is the leading cause because these are really mature projects that have highly skilled developers fixing so much shit.

      So you get these new Rust projects that are sometimes made by people that don’t have the same experience as these C/C++ devs, and they are so confident in the memory safety that they forget about the much simpler security issues.

      • mesa@piefed.socialEnglish
        13·
        10 hours ago

        Cant tell you how many times Ive heard about curl getting re-written. Same deal.

        • otacon239@lemmy.world
          6·
          4 hours ago

          Surely a direct stream from the internet straight onto host hardware can’t be exploited in any way. All you gotta do is put the stream in a file. How hard could it be? (/s)

    • Rikudou_Sage@lemmings.world
      16·
      11 hours ago

      The biggest problem with Rust are its users. They somehow think that having a safe memory access means fewer bugs. While it only means fewer memory management related bugs. Which honestly isn’t even a problem with modern C++.

  • gravitas_deficiency@sh.itjust.worksEnglish
    18·
    10 hours ago

    So:

    • yes, that’s pretty sketchy
    • this is also AFAIK the first major distro that it’s been a part of as a stock install, so this is the first exposure at scale that the project has had; as unfortunate as it is, it can be argued that this might fall under “teething issues”
    • with that said, it sounds like the rust coreutils people need to step up their game in terms of thinking in and testing for adversarial contexts. Normal test cases do not cut it when you’re dealing with stuff like sudo - it needs to be put through the ringer.
    • just_another_person@lemmy.world
      19·
      9 hours ago

      Gonna say what I said so many times, and even a few times in this comment section.

      ALL.software.has.bugs.

      The language doesn’t matter. AI doesn’t matter. Testing doesn’t matter. Every single piece of software will be vulnerable to something eventually.

      Staying on top of it is the best you can do.

  • Aatube@kbin.melroy.org
    11·
    10 hours ago

    One of the patches is to prevent the sudo password from being leaked in case of a timeout or sudo being killed. Another patch is to use enum for the feedback parameter. Another patch to ensure feedback is always erased before exiting the read unbuffered code. Another change is also made to not treat backspace as a password character when the password is empty.

      • pizza_the_hutt@sh.itjust.worksEnglish
        8·
        10 hours ago

        The latest LTS release has really old software. The problem here is that the Ubuntu heads are pushing for replacement of core system utilities that aren’t ready for prime time. These Rust components need at least another year to cook. This is just the latest bad decision from Ubuntu leadership. See SNAP.

        If you want stability, just get Debian. If you need newer software, get an Arch-based distro.

        • Aatube@kbin.melroy.org
          7·
          9 hours ago

          i do use arch

          is April 2024 software that old?

          replacement of core system utilities that aren’t ready for prime time

          Could we talk about Unity? I’d wager that these bugs wouldn’t have been found by 2027 if Ubuntu hadn’t adopted sudo-rs. And I’d say “look at where Unity is right now” if they hadn’t switched to GNOME Shell.

          • caseyweederman@lemmy.ca
            2·
            8 hours ago

            Yeah, fair. And 25.10 is a short-term release anyway. The point of it is to get a running start on 26.04.

      • Dagnet@lemmy.worldEnglish
        7·
        10 hours ago

        ubuntu 24 LTS here and never had an issue. As someone who came from windows and played around with fedora for a while its kinda really surprising.