From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
If anybody is interested: distros like Secureblue and Kicksecure (and Kicksecure-based ones like Whonix) reduce attack surface by disabling a bunch of kernel modules, and further harden the kernel via sysctl settings and kernel arguments. Secureblue also sends a notification whenever a system update fixes a vulnerability.
https://secureblue.dev/features
https://www.kicksecure.com/#security
So how many of the 900 are they vulnerable to?
The devs haven't said anything about this one AFAIK, though we can at least look at last year's AI-found LPEs.
Secureblue mitigated Copy Fail and blocked the xfrm-ESP exploit path for Dirty Frag. You can read more about it here.
Kicksecure did neither, as SUID and unprivileged user namespaces aren't disabled by default. You also can't selectively enable user namespaces after disabling it, which worsens security for web browsers and breaks some stuff.
let's wait an see what Greg KH has to say about this.
Discovering nearly one thousand local privilege escalation vulnerabilities consumed $1.2 million USD in API credits.
😅
A bargain!
sudo make me a sandwich
makes sandwich
oh my god
How can you talk? You're a sandwich! Clearly these bugs run deeper than we thought...
Ah, I’ve missed cuil theory
Where there is no thought, there is always deeper...
it's a bit odd how openai's blog post makes it sound like security bugs in Linux fall in two categories, info leak and local privilege escalation. i would guess that they probably did also ask their model to find some RCEs, but they're selling those to exploit vendors (or perhaps to intelligence agencies directly?) rather than blogging about fixing them.
That's terrifying holy shit
Alternatively, many of these exploits are dependent on extremely niche situations that are mostly handled by existing safeguards.
I'd be interested to see the actual real world severity of these - are they actually things that could be used in an exploit in any meaningful way?
RCE is substantially more severe, it's possible there just aren't as many, as they aren't as applicable to highly contrived scenarios
no they didn't.
what do you mean?
If you have ever actually seen the discovery process, you'll understand that bugs and rce's don't just popup on a list from a computer. Sure, you can generate a list of places to start testing, but each of those has to be validated, reproduced, documented and understood before it's confirmed. It's not just the discovery of a starting point that constitutes an rce or other vuln, there's a ton of work that needs to be done by humans also.
So a few bad ones in the news? Sure. A list of 1500 non-validated rces? I'm not holding my breath.
You really have to think critically and let go of the "hacker" sensationalism in infosec, it's easy to fall into.
Sure, you can generate a list of places to start testing, but each of those has to be validated, reproduced, documented and understood before it’s confirmed
i guess you didn't actually read the blog post this article links to? The number in the headline (948) is the number of LPE bugs which they say they validated and reproduced and developed exploits (and patches) for.
I did. The article is scant, and the source report is everything bad about ai in the vuln world; high drama, low info. LPEs are not RCEs!
And we don't know what the exploits are. If it's a bunch of local jvm consoles or vi escapes into shell where it's like "oh this could give you root!", that's not super useful without knowing if it's a dumb initial config or an actual use-after-free or other memory exploit.
That's why we don't classify manufacturers with bad/no default creds as CVEs, that's just bad
Like I said, there is a lot of work to do before these become legit, and it almost certainly won't be 958 exploits after actual professionals review them properly.
And again, stop taking OpenAI at their word about security.
LPEs are not RCEs
They didn't say they were, the post is very clear about the the 948 vulns they're talking about being LPE.
If it’s a bunch of local jvm consoles or vi escapes into shell
if it was that, they wouldn't be "Linux LPEs". These are clearly kernel bugs they're talking about.
And again, stop taking OpenAI at their word about security.
OpenAI is full of shit about a lot of things but I doubt they're lying about having working exploits for these Linux bugs.
I don't want to belabour the point, but openai also said it's agents "hacked" hugging face, but that is now documented as very 'helped along', so take their claims however you like.
What that tells me is that LLM agents can augment human hackers to perform feets neither could do on their own.
I don't know why I would then conclude OpenAI is simply lying about even finding exploits. It's believable that human programmers, using LLMs, have been able to find exploits. They're going to lie and give more credit to the Wizard than to the man behind the curtain, but that doesn't mean the exploits themselves aren't real.
The amount of people who will speak confidently without knowing the full picture is astounding.
948 is an absurd number to bugs to find at one time. i bet most of them are fake. i've seen the "bugs" AI likes to find
Tell me you haven't read the article without telling me you haven't read the article.
indeed i haven't, because the title is such absolute bullshit and AI propaganda that there's no point entertaining it.
indeed i haven't
I rest my case.
I haven't read the article.
I do not trust AI. We've seen too many mishaps from it. That technology is too early for us to truly comprehend. And now... AI is finding all sort of things wrong with Linux which has been running darn near perfect for how many years now not counting system upgrades over hat is. Then again...I'm no programmer so I could be out in left field.
That last statement is the only correct thing you wrote.
My apologies if I have insulted your deep professional knowledge in this matter...
Pretty much finding these kind of errors ARE what vibecoding is good for, AI is pretty good at repetitive tasks like reimplementations,de/recompilations and similar which needs dinamic automation,cybersecurity is one of those matters where AI is pretty good at.