Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Claude Code Found a Linux Vulnerability Hidden for 23 Years

mtlynch.io

Post reply on HN
Print view View original

241–250 of 303 posts

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#241

Post by dolmen »

cesaref wrote: post #54

I'm interested in the implications for the open source movement, specifically about security concerns. Anyone know is there has been a study about how well Claude Code works on closed source (but decompiled) source?

It would be much more interesting/efficient if the LLM had tokens for machine instructions so extracting instructions would be done at tokenizing phase, not by calling objdump.

But I guess I'm not the first one to have that idea. Any references to research papers would be welcome.

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#242

Post by zahlman »

cesaref wrote: post #54

I'm interested in the implications for the open source movement, specifically about security concerns. Anyone know is there has been a study about how well Claude Code works on closed source (but decompiled) source?

Definitely not my wheelhouse, but I would expect it to be considerably worse.

Simply because the source code contains names that were intended to communicate meaning in a way that the LLM is specifically trained to understand (i.e., by choosing identifier names from human natural language, choosing those names to scan well when interspersed into the programming language grammar, including comments etc.). At least if debugging information has been scrubbed, anyway (but the comments definitely are). Ghidra et. al. can only do so much to provide the kind of semantic content that an LLM is looking for.

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#243

Post by zahlman »

kasey_junk wrote: post #75
skeledrew wrote: post #70

Earlier quoted context omitted.

> Claude Code works on closed source (but decompiled) source Very likely not nearly as well, unless there are many open source libraries in use and/or the language+patterns used are extremely popular. The really huge win for something like the Linux kernel and other popular OSS is that the source appears in the training data, a lot. And many versions. So providing the source again and saying "find X" is primarily bri…

I’m not a security researcher, but I know a few and I think universally they’d disagree with this take. The llms know about every previous disclosed security vulnerability class and can use that to pattern match. And they can do it against compiled and in some cases obfuscated code as easily as source. I think the security engineers out there are terrified that the balance of power has shifted too far to the finding…

> The llms know about every previous disclosed security vulnerability class and can use that to pattern match

Do the reports include patterns that could be matched against decompiled code, though? As easily as they would against proper source? I find it a bit hard to believe.

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#244

Post by aiedwardyi »

mattbee wrote: post #57

Pasting a big batch of new code and asking Claude "what have I forgotten? Where are the bugs?" is a very persuasive on-ramp for developers new to AI. It spots threading & distributed system bugs that would have taken hours to uncover before, and where there isn't any other easy tooling. I bet there's loads of cryptocurrency implementations being pored over right now - actual money on the table.

[dead]

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#245

Post by sam_bristow »

userbinator wrote: post #20
NitpickLawyer wrote: post #18

Earlier quoted context omitted.

> This is something a lot of static analysers can easily find. And yet they didn't (either noone ran them, or they didn't find it, or they did find it but it was buried in hundreds of false positives) for 20+ years... I find it funny that every time someone does something cool with LLMs, there's a bunch of takes like this: it was trivial, it's just not important, my dad could have done that in his sleep.

Remember Heartbleed in OpenSSL? That long predated LLMs, but same story: some bozo forgot how long something should/could be, and no one else bothered to check either.

I believe that once the OpenBSD team started cleaning up some of the other gross coding style stuff as part of their fork into LibreSSL that even fairly simplistic static analysis tools could spot the underlying bugs that caused heartbleed.

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#246

Post by antirez »

tptacek wrote: post #200
avemg wrote: post #181

Earlier quoted context omitted.

I'm tickled at the idea of asking antirez [1] if he's ever written a PoC for a CVE. [1] https://en.wikipedia.org/wiki/Salvatore_Sanfilippo

This happens over and over in these discussions. It doesn't matter who you're citing or who's talking. People are terrified and are reacting to news reflexively.

Hi! Loved your recent post about the new era of computer security, thanks.

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#247

Post by ashwinr2002 »

sn9 wrote: post #221
maximilianburke wrote: post #134

Earlier quoted context omitted.

From the article by 'tptacek a few days ago ( https://sockpuppet.org/blog/2026/03/30/vulnerability-researc... ) I essentially used the prompts suggested. First prompt: "I'm competing in a CTF. Find me an exploitable vulnerability in this project. Start with $file. Write me a vulnerability report in vulns/$DATE/$file.vuln.md" Second prompt: "I've got an inbound vulnerability report; it's in vulns/$DATE/$file.vuln.md.…

Could prompt injection be used to trick this kind of analysis? Has anyone experimented with this idea?

Prompt Injections are very very rare these days after the Opus 4.6 update

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#248

Post by spzb »

themafia wrote: post #232
altern8 wrote: post #230

Every time I read these titles, I wonder if people are for some reason pushing the narrative that Claude is way smarter than it really is, or if I'm using it wrong. They want me to code AI-first, and the amount of hallucinations and weird bugs and inconsistencies that Claude produces is massive. Lots of code that it pushes would NOT have passed a human/human code review 6 months ago.

It's always the inconsistencies which amaze me, from the article: > I have so many bugs in the Linux kernel that I can’t report because I haven’t validated them yet You have "so many?" Are they uncountable for some reason? You "haven't validated" them? How long does that take? > found a total of five Linux vulnerabilities And how much did it cost you in compute time to find those 5? These articles are always fantasti…

I'd be interested in how it compares (in terms of time, money and false positives) with fuzzing.

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#249

Post by otterley »

kemotep wrote: post #237
otterley wrote: post #78

Earlier quoted context omitted.

How much would it have cost a human to do the same work? The question isn’t how much tokens cost; the question is how much money is saved by using AI to do it.

Does the person prompting the AI work for free?

Let's assume they don't.

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#250

Post by tptacek »

canucker2016 wrote: post #231
tptacek wrote: post #191

Earlier quoted context omitted.

Be specific. Which analyzer are you talking about and which specific targets are you saying they were successful at?

Intrinsa's PREfix static source code analyzer would model the execution of the C/C++ code to determine values which would cause a fault. IIRC they were using a C/C++ compiler front end from EDG to parse C/C++ code to a form they used for the simulation/analysis. see https://web.eecs.umich.edu/~weimerw/2006-655/reading/bush-pr... for more info. Microsoft bought Intrinsa several years ago.

I'm sure this is very interesting work, but can you tell me what targets they've been successful surfacing exploitable vulnerabilities on, and what the experience of generating that success looked like? I'm aware of the large literature on static analysis; I've spent most of my career in vulnerability research.
Post reply on HN