Over 400 Linux CVEs published in the last 24 hours alone
lore.kernel.org
Over 400 Linux CVEs published in the last 24 hours alone
1–10 of 52 posts
Re: Over 400 Linux CVEs published in the last 24 hours alone
#2Might need to silently archive those Microsoft Patch Tuesday jokes...
Re: Over 400 Linux CVEs published in the last 24 hours alone
#3https://docs.kernel.org/process/cve.html
> Note, due to the layer at which the Linux kernel is in a system, almost any bug might be exploitable to compromise the security of the kernel, but the possibility of exploitation is often not evident when the bug is fixed. Because of this, the CVE assignment team is overly cautious and assign CVE numbers to any bugfix that they identify. This explains the seemingly large number of CVEs that are issued by the Linux kernel team.
(And because this happens during the stable release process, there are a lot of 24-hour periods where they issue a ton of CVEs for all the minor bugs fixed in the release.)
Re: Over 400 Linux CVEs published in the last 24 hours alone
#4I am assuming that many of these are found with automatic analysis tools that are very creative (i.e. LLMs) and there may be a high proportion of very "cornered" cases. I think there needs to be a triage method that would amount to the severity, likeliness, and detection dimensions used to rank risks in a systematic framework [1]. I think if this could be submitted (or estimated) along with such bug reports, it could go a long way toward sustainable intake patterns for this number of possible defects.
[1]: https://en.wikipedia.org/wiki/Failure_mode_and_effects_analy...
Re: Over 400 Linux CVEs published in the last 24 hours alone
#5Might need to silently archive those Microsoft Patch Tuesday jokes...
Don't worry, Microsoft is still leading:
https://www.bleepingcomputer.com/news/microsoft/microsoft-ju...
Re: Over 400 Linux CVEs published in the last 24 hours alone
#6Linus better put his money where mouth is and fire up those AI tokens ASAP.
I don't consider this a tragedy, it's just unearthing the reality.
Re: Over 400 Linux CVEs published in the last 24 hours alone
#7I am assuming that many of these are found with automatic analysis tools that are very creative (i.e. LLMs) and there may be a high proportion of very "cornered" cases. I think there needs to be a triage method that would amount to the severity, likeliness, and detection dimensions used to rank risks in a systematic framework [1]. I think if this could be submitted (or estimated) along with such bug reports, it could…
In my company, the security team isn’t technical. They see CVE, find a vulnerable system, it gets flagged. We have to patch it.
We patched for a CVE last week that a malicious usb sound card device could be use the gain root.
On a Vm? Is that something we really need to worry about??
Re: Over 400 Linux CVEs published in the last 24 hours alone
#8Might need to silently archive those Microsoft Patch Tuesday jokes...
Those that actually understood security, and weren't on some kind of open-source enforcement mission in life, always knew the "Linux doesn't get viruses" statements would not age well.
https://blog.desdelinux.net/en/virus-in-gnulinux-reality-or-...
Re: Over 400 Linux CVEs published in the last 24 hours alone
#9I guess very few around here remember the minor fuzz about this from a few years ago? The Linux Kernel Project became their own CNA (CVE Numbering Authority). A CVE is now slapped onto practically every bug fix that is back ported to a stable kernel, resulting in a flood of CVEs.
A blog post about this, published at the time: https://sigma-star.at/blog/2024/03/linux-kernel-cna/
The title is editorialized (i.e. the OP made it up), the link simply goes to the kernel CVE mailing list archive.
Re: Over 400 Linux CVEs published in the last 24 hours alone
#10Amazing how people think this means anything