Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SQLite Critical CVEs or LLM Slop?

research.jfrog.com

Post reply on HN
Print view View original

161–170 of 406 posts

Re: SQLite Critical CVEs or LLM Slop?

#161

Post by timedude »

tantalor wrote: post #75
gste wrote: post #60

> The cited code didn't even exist in those versions or referenced unrelated logic. > When testing the PoC payloads they didn’t work (not triggering any crash). I think the future is pretty obvious, if this isn't being done on projects already: you need to automate these checks and reject automatically

Great idea! We can use LLM to do this. LLM: I ran the check and it repro'd > Did you really? LLM: You're absolutely right. I didn't actually run the check. Good catch! One sec let me do that now... yep I ran the check and it definitely repro'd this time. > I hate my job

That is if it didn't completely delete the repo in the first place. Consider yourself lucky

Re: SQLite Critical CVEs or LLM Slop?

#162

Post by estearum »

gortok wrote: post #151
red75prime wrote: post #139

Earlier quoted context omitted.

Apophatic intelligence? "We don't know what intelligence is, but LLMs with CoT are certainly not it despite being Turing-complete." Watching for unexpected failure modes is surely worth it.

Turing-completeness is a necessary pre-requisite for being able to fulfill the requirements of a Turing machine, nothing more. In the same way that cell division is a necessary condition for life, but cell division does not mean a given life form itself is sentient. Intelligent life-forms can generate probabilistic outputs based on inputs, but being able to generate probabilistic outputs based on inputs is not what m…

> but being able to generate probabilistic outputs based on inputs is not what makes us intelligent.

???

Of course it is. The brain is mechanically not capable of doing anything other than that.

Do you believe the brain is something other than a bundle of probabilistic physical interactions? Or are brains not the source of what we call intelligence?

Re: SQLite Critical CVEs or LLM Slop?

#163

Post by SirFatty »

lucideer wrote: post #22
SirFatty wrote: post #10

Earlier quoted context omitted.

ITAR

ITAR has no such hard requirements. Might be some orgs that tell themselves they're attempting this under ITAR but they're not doing it in any comprehensive way. The only thing within ITAR that I'm aware of concerning itself with software supply chain is SP 800-218 requirements & that's just a load of open-to-interpretation weasel words about having CVE detection & automations in place & some defined plans for reduci…

Whatever you say, chief. I worked in that environment for quite a while, and maybe on a technicality you're right, the effect outcome is that you will do it if not for all your customers that will require it.

Re: SQLite Critical CVEs or LLM Slop?

#164

Post by groundzeros2015 »

cogman10 wrote: post #56
flerchin wrote: post #39

Earlier quoted context omitted.

The vast majority of CVEs are not exploitable, basically noise. I suspect that the overwhelming majority of the CVEs being generated by LLMs are either noise of the sort in the linked article or noise of the sort that is not exploitable.

This is what I truly don't like about the CVE system. One such example is CVE-2023-45853 [1]. Zlib included in it's source an extra set of utilities and add-ons. One such utility, MiniZip, had a buffer overflow vulnerability. BAM, 8.8 CVE (was a 9, looks like they pulled it back a bit). But not one that the 99% of applications using zlib would ever be vulnerable to because almost nobody used the MiniZip utility. It w…

Also a buffer overflow in user space for a tool not serving internet traffic is not a big deal.

Re: SQLite Critical CVEs or LLM Slop?

#165

Post by red75prime »

gortok wrote: post #151
red75prime wrote: post #139

Earlier quoted context omitted.

Apophatic intelligence? "We don't know what intelligence is, but LLMs with CoT are certainly not it despite being Turing-complete." Watching for unexpected failure modes is surely worth it.

Turing-completeness is a necessary pre-requisite for being able to fulfill the requirements of a Turing machine, nothing more. In the same way that cell division is a necessary condition for life, but cell division does not mean a given life form itself is sentient. Intelligent life-forms can generate probabilistic outputs based on inputs, but being able to generate probabilistic outputs based on inputs is not what m…

OK. A more pointed question. What do you know about intelligence that allows you to exclude LLMs with CoT from the category of intelligent systems with certainty?

Re: SQLite Critical CVEs or LLM Slop?

#166

Post by cocorebop »

> Over the past few days, a newly created GitHub repo (programmervuln/cveadvisory-) published a batch of SQLite vulnerability advisories (as part of other 50+ CVEs which we believe are also LLM slop except from one). NVD quickly flagged these as critical, and CISA's ADP agreed.

These two sentences seem incompatible to me. A brand new actor can just say some stuff and cause major disruptions in this way?

Re: SQLite Critical CVEs or LLM Slop?

#167

Post by bluGill »

thayne wrote: post #143
delusional wrote: post #118

Earlier quoted context omitted.

Thats not enough. This problem pops up everywhere people do CVE analysis. If a tertiary part of some library is hit by some arbitrary CVE, why should that affect the core functionality people actually use? If I use ChaCha20, and that's bundled in a library with md5.do I care that their md5 library has a vulnerability? No, not really. If you keep driving the "seperate the packages" angle you end up with is-odd, and th…

Even more than that, a lot of vulnerabilities require untrusted input to exploit, but the library or executable is usually only used with trusted input. For example, suppose the chacha20 function had a vulnerability that was exploitable with a malicious secret key, but you only call it with your own, definitely not malicious, key. The vulnerability doesn't impact you, but your security policy might still require you…

I have concluded that even though I won't use that key, I still want the issue fixed. You never know if the key I randomly choose next year is the vulnerable one. Worse, you never know if someone else won't make a bug that allows outsiders to select a key...

Re: SQLite Critical CVEs or LLM Slop?

#168

Post by elmer2 »

gortok wrote: post #52

We can chalk this up as another example of over-exhuberance by what folks believe LLMs can accomplish vs. what they actually are. LLM-based “AI” is able to use its vast corpus of inputs and calculate the most statistically likely output in a given situation. It is probabilistic, and when you are dealing with probabilities in a situation where certainties, not probabilities, matter, you’re going to get dinged on credi…

Many people with no skills are taking advantage of the LLM craze to artificially inflate their own value. I see it every day on LinkedIn.

People that previously have barely any experience in tech, now being hired in AI startups because they are good bullshitters.

Re: SQLite Critical CVEs or LLM Slop?

#169

Post by bluGill »

gwerbin wrote: post #130
dspillett wrote: post #94

Earlier quoted context omitted.

> The vast majority of CVEs are not exploitable, basically noise. This is not true if you consider security-in-depth. Many of them are exploitable on their own but maybe not in combination with other issues that are as yet unknown or known but not patched everywhere. As a simple example a local privilege escalation issue that is not exploitable on a device that only I ever have access to, essentially becomes a remote…

This is the most common "not exploitable" CVE I have to deal with at work all the time. Things like buffer overruns when passing headers, but my server shouldn't be accessible to the public Internet anyway, and if it is, then we have much bigger problems. So yes it's technically exploitable IF other safeguards fail, but the reason it's irrelevant is that if those other safeguards fail, we are in deep shit anyway.

Or you can just fix the issue that way if IT screws up you are not vulnerable. Or maybe next year you will decide it is useful to connect to the internet.

Re: SQLite Critical CVEs or LLM Slop?

#170

Post by nullsanity »

estearum wrote: post #162
gortok wrote: post #151

Earlier quoted context omitted.

Turing-completeness is a necessary pre-requisite for being able to fulfill the requirements of a Turing machine, nothing more. In the same way that cell division is a necessary condition for life, but cell division does not mean a given life form itself is sentient. Intelligent life-forms can generate probabilistic outputs based on inputs, but being able to generate probabilistic outputs based on inputs is not what m…

> but being able to generate probabilistic outputs based on inputs is not what makes us intelligent. ??? Of course it is. The brain is mechanically not capable of doing anything other than that. Do you believe the brain is something other than a bundle of probabilistic physical interactions? Or are brains not the source of what we call intelligence?

[dead]
Post reply on HN