Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Claude Code Found a Linux Vulnerability Hidden for 23 Years

mtlynch.io

Post reply on HN
Print view View original

161–170 of 303 posts

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#161

Post by tptacek »

skeledrew wrote: post #87
kasey_junk wrote: post #75

Earlier quoted context omitted.

I’m not a security researcher, but I know a few and I think universally they’d disagree with this take. The llms know about every previous disclosed security vulnerability class and can use that to pattern match. And they can do it against compiled and in some cases obfuscated code as easily as source. I think the security engineers out there are terrified that the balance of power has shifted too far to the finding…

Many vulnerabilities aren't just pattern matching though; deep understanding of the context in the particular codebase is also needed. And a novel codebase means more attention than usual will be spent grepping and keeping the context in focus. Which will make it easier to miss certain things, than if enough of the context was already encoded in the model weights. Same thing applies to humans: the better someone know…

Almost all vulnerabilities are either direct applications of known patterns, incremental extensions of them, or chains of multiple such steps.

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#162

Post by tptacek »

cookiengineer wrote: post #63
dist-epoch wrote: post #29

Earlier quoted context omitted.

> On the kernel security list we've seen a huge bump of reports. We were between 2 and 3 per week maybe two years ago, then reached probably 10 a week over the last year with the only difference being only AI slop, and now since the beginning of the year we're around 5-10 per day depending on the days (fridays and tuesdays seem the worst). Now most of these reports are correct, to the point that we had to bring in mo…

> https://syzbot.org/upstream I stand corrected.

What's your point?

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#163

Post by watermelon0 »

monocularvision wrote: post #150
blks wrote: post #117

Earlier quoted context omitted.

Read ToS.

I just did. Tell me where it states what you are claiming. Neither my reading (IANAL) nor ChatGPT’s reading could find such a blanket ban: https://www.anthropic.com/legal/consumer-terms

From your link:

> Non-commercial use only. You agree that you will not use our Services for any commercial or business purposes and we and our Providers have no liability to you for any loss of profit, loss of business, business interruption, or loss of business opportunity.

There are separate commercial terms for Team/Enterprise/API usage: https://www.anthropic.com/legal/commercial-terms

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#164

Post by discordianfish »

antirez wrote: post #115
jason1cho wrote: post #25

This isn't surprising. What is not mentioned is that Claude Code also found one thousand false positive bugs, which developers spent three months to rule out.

That's not what is happening right now. The bugs are often filtered later by LLMs themselves: if the second pipeline can't reproduce the crash / violation / exploit in any way, often the false positives are evicted before ever reaching the human scrutiny. Checking if a real vulnerability can be triggered is a trivial task compared to finding one, so this second pipeline has an almost 100% success rate from the POV: i…

I’ve been around long enough to remember people saying that VMs are useless waste of resources with dubious claims about isolation, cloud is just someone else’s computer, containers are pointless and now it’s AI. There is a astonishing amount of conservatism in the hacker scene..

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#165

Post by antirez »

uhx wrote: post #154
antirez wrote: post #115

Earlier quoted context omitted.

That's not what is happening right now. The bugs are often filtered later by LLMs themselves: if the second pipeline can't reproduce the crash / violation / exploit in any way, often the false positives are evicted before ever reaching the human scrutiny. Checking if a real vulnerability can be triggered is a trivial task compared to finding one, so this second pipeline has an almost 100% success rate from the POV: i…

> Checking if a real vulnerability can be triggered is a trivial task compared to finding one Have you ever tried to write PoC for any CVE? This statement is wrong. Sometimes bug may exist but be impossible to trigger/exploit. So it is not trivial at all.

Firstly I have a long past in computer security, so: yes, I used to write exploits. Second, the vulnerability verification does not need being able to exploit, but triggering an ASAN assert. With memory corruption that's very simple often times and enough to verify the bug is real.

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#166

Post by pdntspa »

discordianfish wrote: post #164
antirez wrote: post #115

Earlier quoted context omitted.

That's not what is happening right now. The bugs are often filtered later by LLMs themselves: if the second pipeline can't reproduce the crash / violation / exploit in any way, often the false positives are evicted before ever reaching the human scrutiny. Checking if a real vulnerability can be triggered is a trivial task compared to finding one, so this second pipeline has an almost 100% success rate from the POV: i…

I’ve been around long enough to remember people saying that VMs are useless waste of resources with dubious claims about isolation, cloud is just someone else’s computer, containers are pointless and now it’s AI. There is a astonishing amount of conservatism in the hacker scene..

Well, the cloud is someone else's computer.

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#167

Post by ruszki »

embedding-shape wrote: post #71
amelius wrote: post #65

Earlier quoted context omitted.

Unfortunately, also in the hands of the __wrong__ people. Maybe even more so, because who is going to wade through all those false positives? A bad actor is maybe more likely to do that.

> A bad actor is maybe more likely to do that. Do something about that then, so white-hat hackers are more likely than black-hat hackers to wanting to wade through that, incentives and all that jazz.

We couldn’t solve the incentive against misinformation/disinformation since inception, we made it even worse than 20 years ago. Even when we know how it works exactly, even on the internet, not just generally. These kinds of statements seem quite unrealistic to me.

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#168

Post by fasterik »

watermelon0 wrote: post #163
monocularvision wrote: post #150

Earlier quoted context omitted.

I just did. Tell me where it states what you are claiming. Neither my reading (IANAL) nor ChatGPT’s reading could find such a blanket ban: https://www.anthropic.com/legal/consumer-terms

From your link: > Non-commercial use only. You agree that you will not use our Services for any commercial or business purposes and we and our Providers have no liability to you for any loss of profit, loss of business, business interruption, or loss of business opportunity. There are separate commercial terms for Team/Enterprise/API usage: https://www.anthropic.com/legal/commercial-terms

I suspect you are accessing their website from a European IP address. The clause you quoted is not present for users outside of the EU/UK.

https://news.ycombinator.com/item?id=47590473

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#169

Post by bch »

antirez wrote: post #115
jason1cho wrote: post #25

This isn't surprising. What is not mentioned is that Claude Code also found one thousand false positive bugs, which developers spent three months to rule out.

That's not what is happening right now. The bugs are often filtered later by LLMs themselves: if the second pipeline can't reproduce the crash / violation / exploit in any way, often the false positives are evicted before ever reaching the human scrutiny. Checking if a real vulnerability can be triggered is a trivial task compared to finding one, so this second pipeline has an almost 100% success rate from the POV: i…

> This is expected in the normal population

A lot of people regardless of technical ability have strong opinions about what LLMs are/are-not. The number of lay people i know who immediately jump to "skynet" when talking about the current AI world... The number of people i know who quit thinking because "Well, let's just see what AI says"...

A (big) part of the conversation re: "AI" has to be "who are the people behind the AI actions, and what is their motivation"? Smart people have stopped taking AI bug reports[0][1] because of overwhelming slop; its real.

[0] https://www.theregister.com/2025/05/07/curl_ai_bug_reports/

[1] https://gist.github.com/bagder/07f7581f6e3d78ef37dfbfc81fd1d...

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#170

Post by rubendev »

tptacek wrote: post #160
userbinator wrote: post #17

Not "hidden", but probably more like "no one bothered to look". declares a 1024-byte owner ID, which is an unusually long but legal value for the owner ID. When I'm designing protocols or writing code with variable-length elements, "what is the valid range of lengths?" is always at the front of my mind. it uses a memory buffer that’s only 112 bytes. The denial message includes the owner ID, which can be up to 1024 by…

"No one bothered to look" is how most vulnerabilities work. Systems development produces code artifacts with compounding complexity; it is extraordinarily difficult to keep up with it manually, as you know. A solution to that problem is big news. Static analyzers will find all possible copies of unbounded data into smaller buffers (especially when the size of the target buffer is easily deduced). It will then report…

With a capable static analyzer that is not true. In many common cases they can deduce the possible ranges of values based on branching checks along the data flow path, and if that range falls within the buffer then it does not report it.
Post reply on HN