64
432 Linux kernel CVEs published in the last 24 hours (lore.kernel.org)
submitted 3 months ago by to c/linux@programming.dev
15 comments fedilink hide all child comments
 

Comments

all 15 comments

sorted by: hot top controversial new old
[–] 41 points 3 months ago

Context: https://tuxcare.com/blog/the-great-kernel-cve-flood-of-2024/

Summary: After Linus's previous stance that security vulnerabilities are just bugs and don't require special treatment, the kernel's new policy is that almost every bug gets a CVE if it has the potential to become a security vulnerability.

  • permalink
  • fedilink
  • source
    •
    [–] 34 points 3 months ago

    Just for those who don't know: Every bug or issue in the Kernel is treated as a CVE. That's why the number seems to that high.

  • permalink
  • fedilink
  • source
    •
    [–] 20 points 3 months ago

    To my understanding, these are confirmed vulnerabilities and have been resolved in 7.1. I have not checked all of them but didn’t find any CVEs without a note on the fixed kernel version.

  • permalink
  • fedilink
  • source
    •
    [–] 9 points 3 months ago (11 children)

    Most definitely AI, but why is Greg posting it like this? Wouldn't it be more natural to post sequentially after having verified what the LLM spit out? This seems like he's testing Linus after his pro-AI message...

  • permalink
  • fedilink
  • source
  • hideshow 11 child comments
    •
  • [–] 15 points 3 months ago* (last edited 3 months ago)

    @onlinepersona @floofloof It is a list of already confirmed and fixed problems. Every link has set of links to patches that fixes the problem.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 6 points 3 months ago (8 children)

    Isn't every CVE already confirmed to be a problem?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 8 child comments
    •
  • [–] 3 points 3 months ago (7 children)

    Sure, but the fix isn't written at the same time as the CVE is it? I might be wrong.

    I'd expect the fixes to come sequentially, not in a batch with all having the same timestamp

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 7 child comments
    •
  • [–] 10 points 3 months ago

    In some previous statements Torvalds said that all Ai based CVEs are handled differently and need to be disclosed publicly immediately. His argument was that if someone found a vulnerability or an issue with a LLM, then others will probably too. So hiding it just caused multiple reports of the same issue, because usually CVEs are hidden until they are solved. That might explain why all of them are dumped immediately.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 2 points 3 months ago* (last edited 3 months ago) (5 children)

    For someone who lurks roams that much, and makes baseless claims liberally, you appear to be missing a lot of basic info, like responsible disclosure, gap periods, or the private mailing list every distro is on which allows them time to ship fixes before the vulnerabilities are announced.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 3 points 3 months ago*

    Am I lurking or making many baseless claims? Can't be both. You sound like the "dey teyk r jaaaabs" types that think immigrants are lazy and taking jobs at the same time.

    Reading your post history is looking a troll up the rear.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 0 points 3 months ago (2 children)

    Maybe that's why they asked the question

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 0 points 3 months ago (1 child)

    While it is indeed amusing to think that perma-online often-wrong people are geniuses who perfected the execution of Cunningham's Law. In reality, they couldn't be further from that. And everything they write is second or third hand anyway, often sourced from the bottom-of-the-barrel corners of the internet.

    Watch them call me AI again because of the "while..they", after the magnificent leap of detecting my supposed anti-immigrant sentiment (which is a dog-whistle for "fervent racist" of course).

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 3 months ago

    Not to defend any comment, I have no horse in this race, but being rude to people doesn't usually help your point, and unless you're being rude back in the same thread no one will have enough context to give you benefit of the doubt

  • permalink
  • fedilink
  • source
  • parent