A single asterisk in musl libc hands attackers root on Alpine
*sshole, or when are we going to get rid of C?
A new vulnerability in musl's crypt function lets an unauthenticated attacker gain a possibly root shell on systems like the official Alpine AWS image. The cause isn't memory unsafety but in-band signaling: musl returns "*" for an overlong password, the same value Unix uses to mark a locked account. The author argues C's type system and community norms make such sentinel misuse inevitable, while Rust's culture would force callers to handle the error.
The engineering norms of C developers allow for "*" to be an acceptable sentinel value indicating an error; the engineering norms of Rust developers simply do not.
- PeterWhittaker
This is less a problem with C and more a bad design decision by the musl team. In response to poor practices (programmers not checking what crypt returned), they built an arguably worse one (returning a sentinel value).
Sure, Rust's std::result can make it harder to dumb, but dumb can always find a way.
- zeroCalories
I just really hate rust compile times man
- varispeed
What does it have to do with C? It's just poor design.
It's like blaming poor driving on one's tracksuit.