What’s our prior for p(doom) today…?
You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)
11–20 of 152 posts
Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)
#12Another one. Linux is falling apart faster than it can assign these CVEs.
perhaps this will lead to better AppArmor and SELinux defaults?
Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)
#13I can't quite make out if this is new or not. The attack vector here seems congruent with a similar exploit from a couple months ago [1]
But still might be an open threat. On the email thread Jens seems to think that this is already patched and in stable, he also points out that for this exploit to work (as written in the article) you already need escalated privileges [2] Catchy title though.
[1] https://snailsploit.com/security-research/general/io-uring-z...
Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)
#14Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)
#15Earlier quoted context omitted.
AI is happening.
In each recent case?
AI assistance was explicitly disclosed on yesterday's. Today's has Claude as one of two contributors on this GitHub Pages site at least so it's also very likely.
Agents are capable of finding this kind of stuff now and people are having a field day using them to find high-profile CVEs for fun or profit.
Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)
#16What is happening? I see multiple outages and CVEs is being reported on HN's front page. I've never seen these many security/incident related posts on HN's front page.
i believe a good portion of the cves hitting the front page are moreso because they are ai-related (found partially/in whole by ai) and make for quick upvotes.
Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)
#17Another one. Linux is falling apart faster than it can assign these CVEs.
Falling apart? You mean getting stronger? Every single one of these is an existing hole being patched. It isn't making new holes
Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)
#18CAP_NET/SYS_ADMIN is required for this. So this would be "not as bad" as the others.
Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)
#19Another one. Linux is falling apart faster than it can assign these CVEs.
Linux is "falling apart" because it's the highest-profile open source project people can point LLM agents at to find CVEs. It'll come out the other end of this hardened by all of the attention it's getting, but the next few months/years will be... bumpy.
Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)
#20What is happening? I see multiple outages and CVEs is being reported on HN's front page. I've never seen these many security/incident related posts on HN's front page.
> What is happening?
Slowly at first, and then suddenly. AI assisted anything follows this trend. As capabilities improve, new avenues become "good enough" to automate. Today is security.