GNU C Library 2.39 Released With New Tunables, stdbit.h For ISO C2X

[sophisticles]

Actually, I think that suid programs should link against a formally verified libc, which could be done with relibc + prustli for instance.
Code that sees that much reuse everywhere really needs formal proof.

This is why the United States passed the Securing Open Source Act of 2022 and 2023:

https://www.congress.gov/bill/117th-congress/senate-bill/4913

https://www.congress.gov/bill/118th-congress/senate-bill/917/text

The truth is there are a lot of vulnerabilities in Linux via glibc:

https://www.uptycs.com/blog/cve-2023-4911-looney-tunables-glibc-exploit

It's exploits like this one that validated the other poster's claims in his mind. The thing is that this, like most related exploits, is a local privilege escalation vulnerability, in order to make use of it a person has to be sitting in front of a computer running Linux.

The danger of exploits like this one to corporations and government agencies is from inside jobs, threat actors that are withing the organization that wish to hurt the entity or steal data.

It is not possible to pull off these attack vectors remotely.

[Nelson]

It is not possible to pull off these attack vectors remotely.

It absolutely is, you have to compromise the system another way remotely first though. Running the web server as a lower privileged user is sort of a classical step to limit the blast radius upon compromise, as an example, this could potentially circumvent that protection.

its not a “hair on fire” ultra critical exploit, but it’s bad and needs to be addressed.