<description>&lt;p&gt;&lt;span class="TextRun SCXW102062720 BCX0" lang="EN-US" xml:lang= "EN-US" data-contrast="auto"&gt;&lt;span class= "NormalTextRun SCXW102062720 BCX0"&gt;In October 2025, &lt;/span&gt;&lt;span class= "NormalTextRun SpellingErrorV2Themed SCXW102062720 BCX0"&gt;CyberPress&lt;/span&gt;&lt;span class="NormalTextRun SCXW102062720 BCX0"&gt; &lt;/span&gt;&lt;/span&gt;&lt;a class="Hyperlink SCXW102062720 BCX0" href="https://cyberpress.org/redis-use-after-free-vulnerability/" target="_blank" rel="noreferrer noopener"&gt;&lt;span class= "NormalTextRun SCXW102062720 BCX0" data-ccp-charstyle= "Hyperlink"&gt;reported&lt;/span&gt;&lt;/a&gt;&lt;span class= "NormalTextRun SCXW102062720 BCX0"&gt; a critical security vulnerability in the Redis Server, an open-source in-memory database that allowed authenticated attackers to achieve remote code execution through a &lt;/span&gt;&lt;a class= "Hyperlink SCXW102062720 BCX0" href= "https://cwe.mitre.org/data/definitions/416.html" target="_blank" rel="noreferrer noopener"&gt;&lt;span class= "NormalTextRun SCXW102062720 BCX0" data-ccp-charstyle= "Hyperlink"&gt;use-after-free&lt;/span&gt;&lt;/a&gt;&lt;span class= "TextRun SCXW102062720 BCX0" lang="EN-US" xml:lang="EN-US" data-contrast="auto"&gt;&lt;span class= "NormalTextRun SCXW102062720 BCX0"&gt; flaw in the Lua scripting engine. In 2024, another prominent temporal memory safety flaw was found in the &lt;/span&gt;&lt;span class= "NormalTextRun SpellingErrorV2Themed SCXW102062720 BCX0"&gt;Netfilter&lt;/span&gt;&lt;span class="NormalTextRun SCXW102062720 BCX0"&gt; subsystem in the Linux kernel: &lt;/span&gt;&lt;/span&gt;&lt;a class= "Hyperlink SCXW102062720 BCX0" href= "https://nvd.nist.gov/vuln/detail/cve-2024-1086" target="_blank" rel="noreferrer noopener"&gt;&lt;span class= "NormalTextRun SCXW102062720 BCX0" data-ccp-charstyle= "Hyperlink"&gt;CVE-2024-1086&lt;/span&gt;&lt;/a&gt;&lt;span class= "TextRun SCXW102062720 BCX0" lang="EN-US" xml:lang="EN-US" data-contrast="auto"&gt;&lt;span class= "NormalTextRun SCXW102062720 BCX0"&gt;. Bugs related to temporal memory safety, such as use-after-free and double-free vulnerabilities, are challenging issues in C and C++ code. In this podcast&lt;/span&gt;&lt;span class= "NormalTextRun SCXW102062720 BCX0"&gt; from the Carnegie Mellon University Software Engineering Institute (SEI)&lt;/span&gt;&lt;span class= "NormalTextRun SCXW102062720 BCX0"&gt;, &lt;/span&gt;&lt;span class= "NormalTextRun SCXW102062720 BCX0"&gt;Lori Flynn&lt;/span&gt;&lt;span class= "NormalTextRun SCXW102062720 BCX0"&gt;, a senior &lt;/span&gt;&lt;span class= "NormalTextRun SCXW102062720 BCX0"&gt;software security &lt;/span&gt;&lt;span class= "NormalTextRun SCXW102062720 BCX0"&gt;research&lt;/span&gt;&lt;span class= "NormalTextRun SCXW102062720 BCX0"&gt;er in the &lt;/span&gt;&lt;span class= "NormalTextRun SCXW102062720 BCX0"&gt;SEI's &lt;/span&gt;&lt;span class= "NormalTextRun SCXW102062720 BCX0"&gt;CERT Division,&lt;/span&gt;&lt;span class="NormalTextRun SCXW102062720 BCX0"&gt; and David Svoboda&lt;/span&gt;&lt;span class= "NormalTextRun SCXW102062720 BCX0"&gt;, a senior software engineer, also in CERT, &lt;/span&gt;&lt;span class= "NormalTextRun SCXW102062720 BCX0"&gt;sit down with Tim Chick&lt;/span&gt;&lt;span class="NormalTextRun SCXW102062720 BCX0"&gt;, technical manager of CERT's Applied Systems Group, &lt;/span&gt;&lt;span class= "NormalTextRun SCXW102062720 BCX0"&gt;to discuss recent updates to the Pointer Ownership &lt;/span&gt;&lt;span class= "NormalTextRun SCXW102062720 BCX0"&gt;Model for C&lt;/span&gt;&lt;span class= "NormalTextRun SCXW102062720 BCX0"&gt;, a modeling framework designed to improve the ability of developers to statically analyze C programs for errors involving &lt;/span&gt;&lt;span class= "NormalTextRun SCXW102062720 BCX0"&gt;temporal&lt;/span&gt;&lt;span class= "NormalTextRun SCXW102062720 BCX0"&gt; &lt;/span&gt;&lt;span class= "NormalTextRun SCXW102062720 BCX0"&gt;memory. &lt;/span&gt;&lt;/span&gt;&lt;span class="EOP SCXW102062720 BCX0" data-ccp-props="{}"&gt; &lt;/span&gt;&lt;/p&gt;</description>

Software Engineering Institute (SEI) Podcast Series

Members of Technical Staff at the Software Engineering Institute

Temporal Memory Safety in C and C++: An AI-Enhanced Pointer Ownership Model

FEB 9, 202624 MIN
Software Engineering Institute (SEI) Podcast Series

Temporal Memory Safety in C and C++: An AI-Enhanced Pointer Ownership Model

FEB 9, 202624 MIN

Description

In October 2025, CyberPress reported a critical security vulnerability in the Redis Server, an open-source in-memory database that allowed authenticated attackers to achieve remote code execution through a use-after-free flaw in the Lua scripting engine. In 2024, another prominent temporal memory safety flaw was found in the Netfilter subsystem in the Linux kernel: CVE-2024-1086. Bugs related to temporal memory safety, such as use-after-free and double-free vulnerabilities, are challenging issues in C and C++ code. In this podcast from the Carnegie Mellon University Software Engineering Institute (SEI), Lori Flynn, a senior software security researcher in the SEI's CERT Division, and David Svoboda, a senior software engineer, also in CERT, sit down with Tim Chick, technical manager of CERT's Applied Systems Group, to discuss recent updates to the Pointer Ownership Model for C, a modeling framework designed to improve the ability of developers to statically analyze C programs for errors involving temporal memory.