- cross-posted to:
- pulse_of_truth@infosec.pub
- cross-posted to:
- pulse_of_truth@infosec.pub
cross-posted from: https://infosec.pub/post/49770060
Comments
You must log in or # to comment.
Context: https://tuxcare.com/blog/the-great-kernel-cve-flood-of-2024/
Summary: After Linus’s previous stance that security vulnerabilities are just bugs and don’t require special treatment, the kernel’s new policy is that almost every bug gets a CVE if it has the potential to become a security vulnerability.
Still, 432 in 24 hours is a lot. Looks like someone made their job way easier with AI, however I refuse to believe this is slop, as these are some of the most important maintainers on the planet who wouldn’t just throw AI on reviewing code like that.
Most definitely AI, but why is Greg posting it like this? Wouldn’t it be more natural to post sequentially after having verified what the LLM spit out? This seems like he’s testing Linus after his pro-AI message…
Isn’t every CVE already confirmed to be a problem?
Sure, but the fix isn’t written at the same time as the CVE is it? I might be wrong.
I’d expect the fixes to come sequentially, not in a batch with all having the same timestamp
For someone who
lurksroams that much, and makes baseless claims liberally, you appear to be missing a lot of basic info, like responsible disclosure, gap periods, or the private mailing list every distro is on which allows them time to ship fixes before the vulnerabilities are announced.Maybe that’s why they asked the question
