This is going to be fun for organizations that are mandated to patch all CVEs, isn't it?
Those organizations will have to adapt to new reality, ie, that some CVEs are not real.
SQLite Critical CVEs or LLM Slop?
11–20 of 406 posts
Re: SQLite Critical CVEs or LLM Slop?
#12This is going to be fun for organizations that are mandated to patch all CVEs, isn't it?
Create the referenced but non-existent file and then fix it /s
Re: SQLite Critical CVEs or LLM Slop?
#13This is going to be fun for organizations that are mandated to patch all CVEs, isn't it?
I'm very curious what organisations would have such a policy. I can't imagine it being viable for any size of org without significant self-deception (or banning the use of all open source at which point CVEs are moot anyway).
Many orgs (esp w ISO27000) have a vulnerability management policy that involves patching at least critical CVEs within a short timeline. Tools like trivvy make it possible to do the scans…
Re: SQLite Critical CVEs or LLM Slop?
#14This is going to be fun for organizations that are mandated to patch all CVEs, isn't it?
[deleted]
Re: SQLite Critical CVEs or LLM Slop?
#15Somewhat related: https://sqlite.org/cves.html
Re: SQLite Critical CVEs or LLM Slop?
#16This is going to be fun for organizations that are mandated to patch all CVEs, isn't it?
All organisations also have exceptions to policies. This one would be one
Re: SQLite Critical CVEs or LLM Slop?
#17Not validating submissions seems like avenue for massive attack. Flood the whole system with endless false reports. Thus making it significantly less reliable.
Re: SQLite Critical CVEs or LLM Slop?
#18> All advisories in this repo seem AI generated when testing them with Gptzero
I pasted this blog post from "Analysis Matrix" to the end in Gptzero, and it also says the blog post was AI-generated (71% chance of AI, 29% chance of AI-Human mix).
Re: SQLite Critical CVEs or LLM Slop?
#19This is going to be fun for organizations that are mandated to patch all CVEs, isn't it?
It’s honestly not great. The security guys are completely exasperated at my job, we’re wasting time having with these. You take the scam really, investigate for a bit, write up a DNF with justification, they go and up date records, and we all just kinda hope that someone updates the scans so it stops showing up.
Something is going to give, and I suspect that the optimistic open filling is going to get canceled.
Re: SQLite Critical CVEs or LLM Slop?
#20The problem with this kind of thing, is that it reduces the S/N (Signal-to-Noise) ratio, so weeding out the legit CVEs becomes a lot more difficult. But, on the other hand, I do know that LLMs have been discovering a lot of legit CVEs, and I will lay odds that the blackhats are leveraging them to the max.
Edits for clarity: seems like this was a controversial take, which I find pretty interesting.
I believe people took this comment as LLMs being better than security aware engineers who have the time to spend building solid systems.
This wasn't the point, the reality outside "established" tech companies is that software security can be lackluster.
There often simply isn't enough resources to check old software for basic vulnerabilities, outdated packages with known issues, there might be a manager who insists on a certain solution. Or that certain services are on "maintenance mode", but rarely get checked since they're on a certain part of the internal network.
If they are able to properly scan their full software stack for CVE issues, they cannot deal with a flood of CVEs.
----
We're in a transition period where AI will eventually make software much more secure than it ever was.
These noisy CVEs will probably lead to agents verifying vulnerabilities before humans review them.
The problem with agent reviews from what I can think of is:
- cost to use LLMs to review things
- not necessarily easy to plug-and-play in repos: (domain knowledge + vulnerability knowledge)
- especially with anthropic: able to use models defensively, without hitting guardrails
The last one is the most interesting one to me. How does the AI providers know if you're a "good or bad" guy? And does it matter if open source models is catching up?
We're in a kind of cyber arms race wether we like it or not.