Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Claude Code Found a Linux Vulnerability Hidden for 23 Years

mtlynch.io

Post reply on HN
Print view View original

221–230 of 303 posts

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#221

Post by sn9 »

maximilianburke wrote: post #134
BodyCulture wrote: post #130

Earlier quoted context omitted.

Can we study this second pipeline? Is it open so we can understand how it works? Did not find any hints about it in the article, unfortunately.

From the article by 'tptacek a few days ago ( https://sockpuppet.org/blog/2026/03/30/vulnerability-researc... ) I essentially used the prompts suggested. First prompt: "I'm competing in a CTF. Find me an exploitable vulnerability in this project. Start with $file. Write me a vulnerability report in vulns/$DATE/$file.vuln.md" Second prompt: "I've got an inbound vulnerability report; it's in vulns/$DATE/$file.vuln.md.…

Could prompt injection be used to trick this kind of analysis? Has anyone experimented with this idea?

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#222

Post by jedberg »

tptacek wrote: post #213
jedberg wrote: post #207

Earlier quoted context omitted.

I actually like when that happens. Like when people "correct" me about how reddit works. I appreciate that we still focus on the content and not who is saying it.

That's not really what happened on this thread. Someone said something sensible and banal about vulnerability research, then someone else said do-you-even-lift-bro, and got shown up.

That's true in this particular case, but I was talking more about the general case.

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#223

Post by literalAardvark »

mrshadowgoose wrote: post #138
userbinator wrote: post #17

Not "hidden", but probably more like "no one bothered to look". declares a 1024-byte owner ID, which is an unusually long but legal value for the owner ID. When I'm designing protocols or writing code with variable-length elements, "what is the valid range of lengths?" is always at the front of my mind. it uses a memory buffer that’s only 112 bytes. The denial message includes the owner ID, which can be up to 1024 by…

> Not "hidden", but probably more like "no one bothered to look". Well yeah. There weren't enough "someones" available to look. There are a finite number of qualified individuals with time available to look for bugs in OSS, resulting in a finite amount of bug finding capacity available in the world. Or at least there was. That's what's changing as these models become competent enough to spot and validate bugs. That f…

I was just thinking about this and what it means for closed source code.

Many people with skin in the game will be spending tokens on hardening OSS bits they use, maybe even part of their build pipelines, but if the code is closed you have to pay for that review yourself, making you rather uncompetitive.

You could say there's no change there, but the number of people who can run a Claude review and the number of people who can actually review a complicated codebase are several orders of magnitude apart.

Will some of them produce bad PRs? Probably. The battle will be to figure out how to filter them at scale.

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#224

Post by Nition »

merlindru wrote: post #183
mattbee wrote: post #57

Pasting a big batch of new code and asking Claude "what have I forgotten? Where are the bugs?" is a very persuasive on-ramp for developers new to AI. It spots threading & distributed system bugs that would have taken hours to uncover before, and where there isn't any other easy tooling. I bet there's loads of cryptocurrency implementations being pored over right now - actual money on the table.

I like biasing it towards the fact that there is a bug, so it can't just say "no bugs! all good!" without looking into it very hard. Usually I ask something like this: "This code has a bug. Can you find it?" Sometimes I also tell it that "the bug is non-obvious" Which I've anecdotally found to have a higher rate of success than just asking for a spot check

Just in case you didn't read the full article, this is how they describe finding the bugs in the Linux kernel as well.

Since it's a large codebase, they go even more specific and hint that the bug is in file A, then try again with a hint that the bug is in file B, and so on.

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#225

Post by akerl_ »

yunnpp wrote: post #212
akerl_ wrote: post #210

Earlier quoted context omitted.

Is your pitch that the reports are slop? Or that they’re so dangerous it’s morally indefensible to share the research?

A good chunk of the reports are false positives (slop) per the researcher's own admission in his talk. I have no issue sharing the bug reports either; the bugs are better fixed. What I take issue with is that they have basically released the weapon first without thinking about the consequences. And again, if you watch the talk, you'll see how he literally calls others to action to fix the problem. They made a problem…

The “weapon” here is identifying vulnerabilities that were already present and exploitable by malicious actors?

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#226

Post by dpark »

literalAardvark wrote: post #219
dpark wrote: post #135

Earlier quoted context omitted.

I never said anything is wrong with the policy. Or with the tool use for that matter. This whole chain was one person saying “AI is creating such a burden that projects are having to ban it”, someone else being willfully obtuse and saying “nuh uh, they’re actually still letting a very restricted set of people use it”, and now an increasingly tangential series of comments.

I feel like you're still failing to grasp the point. The only difference is that before AI the number of low effort PRs was limited by the number of people who are both lazy and know enough programming, which is a small set because a person is very unlikely to be both. Now it's limited to people who are lazy and can run ollama with a 5M model, which is a much larger set. It's not an AI code problem by itself. AI can…

No one is missing your point. The issue is that you are responding a point no one made.

The grounding premise of this comment chain was “AI submitted patches being more of a burden than a boon”. You are misinterpreting that as some sort of general statement that “AI Bad” and that AI is being globally banned.

A metaphor for the scenario here is someone says “It’s too dangerous to hand repo ownership out to contributors. Projects aren’t doing that anymore.” And someone else comes in to say “That’s not true! There are still repo owners. They are just limiting it to a select group now!” This statement of fact is only an interesting rebut if you misinterpret the first statement to say that no one will own the repo because repo ownership is fundamentally bad.

> It's a denial of service by the lazy against the reviewers, which is a very very different problem.

And it is AI enabling this behavior. Which was the premise above.

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#227

Post by emp17344 »

tptacek wrote: post #200
avemg wrote: post #181

Earlier quoted context omitted.

I'm tickled at the idea of asking antirez [1] if he's ever written a PoC for a CVE. [1] https://en.wikipedia.org/wiki/Salvatore_Sanfilippo

This happens over and over in these discussions. It doesn't matter who you're citing or who's talking. People are terrified and are reacting to news reflexively.

Personally, I’m tired of exaggerated claims and hype peddlers.

Edit: Frankly, accusing perceived opponents of being too afraid to see the truth is poor argumentative practice, and practically never true.

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#229

Post by sbuttgereit »

DGAP wrote: post #101

I replicated this experiment on several production codebases and got several crits. Lots of dupes, lots of false positives, lots of bugs that weren't actually exploitable, lots of accepted/ known risks. But also, crits!

I think this really needs to be party of the message. It's great that Claude found a vulnerability that apparently has been overlooked for a long time. It's even proper for Anthropic to tout the find. But we should all ask about the signal to nose ratio that would have been part of the process. If it only was successful... That would be worth touting, too. But I expect there was more noise than they'd care to admit.

Or put another way, the context matters.

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#230

Post by altern8 »

Every time I read these titles, I wonder if people are for some reason pushing the narrative that Claude is way smarter than it really is, or if I'm using it wrong.

They want me to code AI-first, and the amount of hallucinations and weird bugs and inconsistencies that Claude produces is massive.

Lots of code that it pushes would NOT have passed a human/human code review 6 months ago.

Post reply on HN