More than 70 percent of Microsoft patches are for memory problems

Stefan Mileschin · 13th February 2019, 08:32

Mostly because of C and C++

More than 70 percent of Microsoft patches are for memory safety bugs.

Speaking to the assembled throngs at an Israel Security conference, a Microsoft engineer Matt Miller said that memory safety bugs happen when software, accidentally or intentionally, accesses system memory in a way that exceeds its allocated size and memory addresses.

He said that over the the last 12 years, around 70 percent of all Microsoft patches were fixes for memory safety bugs.

The reason for this high percentage is because Windows has been written mostly in C and C++, two "memory-unsafe" programming languages that allow developers fine-grained control of the memory addresses where their code can be executed.

One slip-up in the developers' memory management code can lead to a slew of memory safety errors that attackers can exploit with dangerous and intrusive consequences --such as remote code execution or elevation of privilege flaws.

Memory safety errors are today's biggest attack surface for hackers, and attackers appear to be capitalising on their availability.

Vole has patched most of the basic memory safety bugs, but attackers and bug hunters have also stepped up their game, moving from basic memory errors that spew code into adjacent memory to more complex exploits that run code at desired memory addresses, ideal for targeting others apps and processes running on the system.

https://fudzilla.com/news/pc-hardwar...emory-problems

13th February 2019, 08:32	#1
Stefan Mileschin [M] Reviewer Join Date: May 2010 Location: Romania Posts: 148,578	More than 70 percent of Microsoft patches are for memory problems Mostly because of C and C++ More than 70 percent of Microsoft patches are for memory safety bugs. Speaking to the assembled throngs at an Israel Security conference, a Microsoft engineer Matt Miller said that memory safety bugs happen when software, accidentally or intentionally, accesses system memory in a way that exceeds its allocated size and memory addresses. He said that over the the last 12 years, around 70 percent of all Microsoft patches were fixes for memory safety bugs. The reason for this high percentage is because Windows has been written mostly in C and C++, two "memory-unsafe" programming languages that allow developers fine-grained control of the memory addresses where their code can be executed. One slip-up in the developers' memory management code can lead to a slew of memory safety errors that attackers can exploit with dangerous and intrusive consequences --such as remote code execution or elevation of privilege flaws. Memory safety errors are today's biggest attack surface for hackers, and attackers appear to be capitalising on their availability. Vole has patched most of the basic memory safety bugs, but attackers and bug hunters have also stepped up their game, moving from basic memory errors that spew code into adjacent memory to more complex exploits that run code at desired memory addresses, ideal for targeting others apps and processes running on the system. https://fudzilla.com/news/pc-hardwar...emory-problems

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Microsoft's Surface sales up 29 percent, phones down 49 percent	Stefan Mileschin	WebNews	0	29th January 2016 08:06
Microsoft Readies Eight Patches For Next Week	Stefan Mileschin	WebNews	0	9th May 2014 09:15
Microsoft Readies Five New Patches for Next Week	Stefan Mileschin	WebNews	0	10th February 2014 07:25
Microsoft Releasing 11 Patches Next Week	Stefan Mileschin	WebNews	0	6th December 2013 08:19
Microsoft stuffs up six patches	Stefan Mileschin	WebNews	0	18th August 2013 16:26
Microsoft Readies Seven Patches for Next Week	Stefan Mileschin	WebNews	0	7th January 2013 07:35
Microsoft Readies Seven Patches for Next Week	Stefan Mileschin	WebNews	0	7th December 2012 07:48
Microsoft to Roll Out Seven Patches Next Week	Stefan Mileschin	WebNews	0	5th October 2012 07:29
Microsoft To Release Nine Patches Next Week	Stefan Mileschin	WebNews	0	10th February 2012 07:06
Microsoft To Provide IE Patches for Windows XP Only	jmke	WebNews	0	23rd September 2004 16:21