Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Claude wrote a full FreeBSD remote kernel RCE with root shell

github.com

Post reply on HN
Print view View original

41–50 of 128 posts

Re: Claude wrote a full FreeBSD remote kernel RCE with root shell

#41

Post by ktm5j »

ptx wrote: post #12

> It's worth noting that FreeBSD made this easier than it would be on a modern Linux kernel: FreeBSD 14.x has no KASLR (kernel addresses are fixed and predictable) and no stack canaries for integer arrays (the overflowed buffer is int32_t[]). What about FreeBSD 15.x then? I didn't see anything in the release notes or the mitigations(7) man page about KASLR. Is it being worked on? NetBSD apparently has it: https://wik…

I don't understand this, because KASLR has been default in FreeBSD since 13.2:

[kmiles@peter ~]$ cat /etc/os-release

NAME=FreeBSD

VERSION="13.3-RELEASE-p4"

VERSION_ID="13.3"

ID=freebsd

ANSI_COLOR="0;31"

PRETTY_NAME="FreeBSD 13.3-RELEASE-p4"

CPE_NAME="cpe:/o:freebsd:freebsd:13.3"

HOME_URL="https://FreeBSD.org/"

BUG_REPORT_URL="https://bugs.FreeBSD.org/"

[kmiles@peter ~]$ sysctl kern.elf64.aslr.enable

kern.elf64.aslr.enable: 1

Re: Claude wrote a full FreeBSD remote kernel RCE with root shell

#42

Post by Fnoord »

alcor-z wrote: post #38

The MADBugs work is solid, but what's sticking with me is the autonomy angle — not just finding a vuln but chaining multiple bugs into a working remote exploit without a human in the loop. FreeBSD kernel security research has always been thinner on the ground than Linux, which makes this feel both more impressive and harder to put in context. What's the actual blast radius here — is this realistically exploitable on…

FTA, top:

> Attack surface: NFS server with kgssapi.ko loaded (port 2049/TCP)

Not sure who would run an internet exposed NFS server. Shodan would know.

Re: Claude wrote a full FreeBSD remote kernel RCE with root shell

#43

Post by savant2 »

ktm5j wrote: post #41
ptx wrote: post #12

> It's worth noting that FreeBSD made this easier than it would be on a modern Linux kernel: FreeBSD 14.x has no KASLR (kernel addresses are fixed and predictable) and no stack canaries for integer arrays (the overflowed buffer is int32_t[]). What about FreeBSD 15.x then? I didn't see anything in the release notes or the mitigations(7) man page about KASLR. Is it being worked on? NetBSD apparently has it: https://wik…

I don't understand this, because KASLR has been default in FreeBSD since 13.2: [kmiles@peter ~]$ cat /etc/os-release NAME=FreeBSD VERSION="13.3-RELEASE-p4" VERSION_ID="13.3" ID=freebsd ANSI_COLOR="0;31" PRETTY_NAME="FreeBSD 13.3-RELEASE-p4" CPE_NAME="cpe:/o:freebsd:freebsd:13.3" HOME_URL=" https://FreeBSD.org/ " BUG_REPORT_URL=" https://bugs.FreeBSD.org/ " [kmiles@peter ~]$ sysctl kern.elf64.aslr.enable kern.elf64.as…

This knob isn't KASLR, it just enables ASLR for ELF binaries.

Re: Claude wrote a full FreeBSD remote kernel RCE with root shell

#44

Post by jsnell »

magicalhippo wrote: post #31
jsnell wrote: post #24

Earlier quoted context omitted.

> Do you have a link to that? A rather important piece of context. It was a quote from your own link from the initial post? https://www.freebsd.org/security/advisories/FreeBSD-SA-26:08... > Credits: Nicholas Carlini using Claude, Anthropic

Oh wow, blind as a bat. Would have been interesting with a write-up of that, to see just what Claude was used for.

Obviously no guarantees that it's exactly what was done in this case, but he talked about his general process recently at a conference and more in depth in a podcast:

https://www.youtube.com/watch?v=1sd26pWhfmg

https://securitycryptographywhatever.com/2026/03/25/ai-bug-f...

It pretty much is just "Claude find me an exploitable 0-day" in a loop.

Re: Claude wrote a full FreeBSD remote kernel RCE with root shell

#45

Post by muskstinks »

magicalhippo wrote: post #3

Key point is that Claude did not find the bug it exploits. It was given the CVE writeup[1] and was asked to write a program that could exploit the bug. That said, given how things are I wouldn't be surprised if you could let Claude or similar have a go at the source code of the kernel or core services, armed with some VMs for the try-fail iteration, and get it pumping out CVEs. If not now, then surely not in a too di…

You might want to watch this:

https://www.youtube.com/watch?v=1sd26pWhfmg

Claude is already able to find CVEs on expert level.

Re: Claude wrote a full FreeBSD remote kernel RCE with root shell

#46

Post by muskstinks »

baq wrote: post #14
panstromek wrote: post #7

The talk "Black-Hat LLMs" just came out a few days ago: https://www.youtube.com/watch?v=1sd26pWhfmg Looks like LLMs are getting good at finding and exploiting these.

Everybody is acts so surprised as if nobody (around here of all places!) read the sama tweet in which he was hiring the Head of Preparedness... in December. https://xcancel.com/sama/status/2004939524216910323

Besides that i'm not reading x, what has this arbitary random tweet todo with antrophic, the yt talk about Opus quality Jump to find exploits no one else was able to find so far?

A theoretical random tweet and a clear demonstration are two different things.

Re: Claude wrote a full FreeBSD remote kernel RCE with root shell

#47

Post by nozzlegear »

m132 wrote: post #28
bluGill wrote: post #25

Earlier quoted context omitted.

Freebsd doesn't have docker. It has jails which can serve a similar purpose but are not the same in important ways

Please at least read the context before attempting to correct me... Here's what I'm referring to: https://github.com/califio/publications/blob/7ed77d11b21db80...

God damn, how much time am I wasting by writing full paragraphs to the Skinner box when I could just write half-formed sentences with no punctuation or grammar?

Re: Claude wrote a full FreeBSD remote kernel RCE with root shell

#49

Post by [deleted] »

muskstinks wrote: post #45
magicalhippo wrote: post #3

Key point is that Claude did not find the bug it exploits. It was given the CVE writeup[1] and was asked to write a program that could exploit the bug. That said, given how things are I wouldn't be surprised if you could let Claude or similar have a go at the source code of the kernel or core services, armed with some VMs for the try-fail iteration, and get it pumping out CVEs. If not now, then surely not in a too di…

You might want to watch this: https://www.youtube.com/watch?v=1sd26pWhfmg Claude is already able to find CVEs on expert level.

[deleted]

Re: Claude wrote a full FreeBSD remote kernel RCE with root shell

#50

Post by shimman »

muskstinks wrote: post #45
magicalhippo wrote: post #3

Key point is that Claude did not find the bug it exploits. It was given the CVE writeup[1] and was asked to write a program that could exploit the bug. That said, given how things are I wouldn't be surprised if you could let Claude or similar have a go at the source code of the kernel or core services, armed with some VMs for the try-fail iteration, and get it pumping out CVEs. If not now, then surely not in a too di…

You might want to watch this: https://www.youtube.com/watch?v=1sd26pWhfmg Claude is already able to find CVEs on expert level.

A talk given by an employee that stands to make millions from Anthropic going public, definitely not a conflict of interest by the individual.
Post reply on HN