Hacker News

points by 0x00cl 3 days ago | 0 comments

I'm going to assume that there was "old" code that caused LPE vulnerabilities, but, The Linux Foundation have their own project Sashiko (https://sashiko.dev/), which analyzes each commit to the Linux Kernel for bugs and vulnerabilities using Googles models, my question is then, how many of the vulnerabilities you found were also caught by Sashiko?

[–] paxy 3 days ago

If Sashiko had found them then they wouldn't have been merged, so my guess is 0

[–] 0x00cl 3 days ago

That's fair, but I guess the question is whether analyzing each commit can find vulnerabilities or it takes more than that (aside from using Google models). It is possible they might have dismissed Sashiko review because they thought it wasn't possible or didn't make sense.

Then the question becomes how many vulnerabilities Sashiko didn't catch (If they use/review Sashikos review)