points by tptacek 1 day ago | 0 comments
That's a good catch. Yes, since they've only proven this up to the jailer boundary, you'd need a second and relatively powerful LPE vulnerability to get real host control out of this.
[–] rvz 1 day ago
[–] imnotsuretheykn 21 hours ago
Watch Hartman’s response to the first wave of issues found by AI. Super dismissive and ignorant.
I’m not sure the people that caused this will be the one fixing it.
[–] fock 16 hours ago
you sure the people who caused this (speeding up Linux to mainly serve ads instead of hardening it?) aren't the exact same people now pushing the antidote?
[–] rockskon 1 day ago
And how many of these vulns are in code for legacy hardware or filesystem support that in no way reflects threats against modern Linux installs? I wager the overwhelming majority of them.
[–] codedokode 1 hour ago
And are those legacy filesystems disabled by default and require root to invoke the code?
[–] devmor 1 day ago
We always knew this, it has been understood since nearly the dawn of the monokernel OS that there is always a route to privilege escalation somewhere. This is why even for web applications that would be better served by a shell, people choose CGI-style interfaces instead.
The only reason it wasn't seen as a problem was due to the effort and time it took to find and exploit them.
Another wave of vulnerabilities like this are yet to be discovered in Linux. We are just seeing how weak C and C++ based OSes and kernels are when put under hundreds of AI agents.
[0] https://openai.com/index/a-thousand-fewer-paths-to-root/