This is and has been a common term in any systems programming concept for decades. You can, for example, search CVEs and easily find some from over 15 years ago: https://www.cve.org/CVERecord?id=CVE-2010-1119
replyIt was even enumerated in the first pass of CWE as CWE-416 in 2006.
I'm surprised that UAF as an acronym is apparently unusual even among people familiar with use-after-free as a concept. I thought that was a pretty typical acronym in the context of software.
replyif you have spend any amount of time in low level c vulnerabilities you will have heard about it, it is a very common time on the low level/cybersec space.
replyYes, it was a common attack vector in binary exploitation. Heap based attack vector like use after free, double free, heap overflows, and others are pretty neat. They force you to learn a lot about how malloc works.
replyThere is a lot of cool work that went into making memory allocation work well; the different arenas, fast bins, chunk headers, etc. are super cool.
yes, it’s a very common term in infosec. I haven’t heard the “UAF” acronym before though
replyI've heard of use after free, but I've only heard UAF to mean Ukraine Armed Forces.
replyIt has been a known bug class for quite some time.
replyHuh? That is a really common term. There have been even memes about it. I remember roughly 5 years ago I first heard the ironic; "Real men use after free" in a discussion about Rust's benefits as its borrowing checker would have also prevented this one.
reply"Use after free" is also described in most standard books about C as a thing you should never do, have you read one?
I haven't really seen it as an acronym "UAF", but I can't recall the first time I heard "use after free". It was probably in the previous century.
replyThe idea that Claude came up with it is ridiculous.
You have somehow lived in a strange bubble.
reply2025: https://redis.io/blog/security-advisory-cve-2025-49844/ 2023: https://seclists.org/oss-sec/2023/q2/133 2022: https://www.zerodayinitiative.com/advisories/ZDI-22-1690/ 2014: https://ftp.openbsd.org/pub/OpenBSD/patches/5.4/common/008_o...
It's an issue as old as time, or thereabouts.
[flagged]
replyPlease don't be snarky or cross into putdowns or personal attack. We're all in (let's call it) the unlucky 10,000 about something. About most things actually.
replyTo an extent that's fair, but you do understand that "ive not heard of a vulnerability older than me" begs credulity? Especially with the fifteen years experience comment? I'm all for not being snarky (I'm not), but this was bait
replyI can understand why it had that effect on you but these are effects it's necessary to resist. From https://news.ycombinator.com/newsguidelines.html, for example: "Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith."
replyThere is an interesting episode of This American Life about how everyone, everyone, has weird gaps in their knowledge that eventually get filled in sometimes fun or humiliating ways. You have these too.
replyWow, what is that episode? I haven't listened to TAL in probably more than a decade but it was great for a long time, and for all I know still is.
reply"A Little Bit of Knowledge"
replyI can see that you're old and that I'm older, but I fail to see the justification for being snarky about that.
reply Please don't sneer, including at the rest of the community.
[flagged]
replyAnd a wrong justifies a wrong?
replyThese are the times we make.
[flagged]
reply[flagged]
replyI understand the response (hence https://news.ycombinator.com/item?id=48887373) but please don't react by breaking the site guidelines yourself. That only makes things worse.
reply[flagged]
replyHey guys - please don't do tit for tat spats on HN. I know how it feels (believe me, I know how it feels down to such a level that any hypothetical offspring would also know how it feels), but it only makes everything worse.
reply[flagged]
replyHey guys - please don't do tit for tat spats on HN. I know how it feels (believe me, I know how it feels down to such a level that any hypothetical offspring would also know how it feels), but it only makes everything worse.
reply