I used o3 to find a remote zeroday in the Linux SMB implementation
1–10 of 232 posts
Re: I used o3 to find a remote zeroday in the Linux SMB implementation
#2Very interesting. Is the bug it found exploitable in practice? Could this have been found by syzkaller?
Re: I used o3 to find a remote zeroday in the Linux SMB implementation
#3(To be clear, I'm not the author of the post, the title just starts with "How I")
Re: I used o3 to find a remote zeroday in the Linux SMB implementation
#4Very interesting. Is the bug it found exploitable in practice? Could this have been found by syzkaller?
I case anyone else didn't recognize that word: https://github.com/google/syzkaller
Re: I used o3 to find a remote zeroday in the Linux SMB implementation
#5Noteable:
> o3 finds the kerberos authentication vulnerability in 8 of the 100 runs
And I'd guess this only became a blog post because the author already knew about the vuln and was just curious to see if the intern could spot it too, given a curated subset of the codebase
Re: I used o3 to find a remote zeroday in the Linux SMB implementation
#6Noteable: > o3 finds the kerberos authentication vulnerability in 8 of the 100 runs And I'd guess this only became a blog post because the author already knew about the vuln and was just curious to see if the intern could spot it too, given a curated subset of the codebase
He did do exactly what you say – except right after that, while reviewing the outputs, he found that it had also discovered a different 0day.
Re: I used o3 to find a remote zeroday in the Linux SMB implementation
#7The article cites a signal to noise ratio of ~1:50. The author is clearly deeply familiar with this codebase and is thus well-positioned to triage the signal from the noise. Automating this part will be where the real wins are, so I'll be watching this closely.
Re: I used o3 to find a remote zeroday in the Linux SMB implementation
#8Does the vulnerability exist in other implementations of SMB?
Re: I used o3 to find a remote zeroday in the Linux SMB implementation
#9The article cites a signal to noise ratio of ~1:50. The author is clearly deeply familiar with this codebase and is thus well-positioned to triage the signal from the noise. Automating this part will be where the real wins are, so I'll be watching this closely.
I was thinking about this the other day, wouldn't it be feasible to make fine-tune or something like that into every git change, mailist, etc, the linux kernel has ever hard?
Wouldn't such an LLM be the closer -synth- version of a person who has worked on a codebase for years, learnt all its quirks etc.
There's so much you can fit on a high context, some codebases are already 200k Tokens just for the code as is, so idk
Re: I used o3 to find a remote zeroday in the Linux SMB implementation
#10The article cites a signal to noise ratio of ~1:50. The author is clearly deeply familiar with this codebase and is thus well-positioned to triage the signal from the noise. Automating this part will be where the real wins are, so I'll be watching this closely.
[deleted]