YHK - yet another hacker news clone

Several Linux kernel vulnerabilities accidentally posted to public mailing list

77 points mrkn1 1 hour ago 17 comments

ivanmontillam 52 minutes ago | parent

It's being a great season, techsecurity-wise.

Avicebron 42 minutes ago | parent

On HN everyone is a security engineer.

gilrain 37 minutes ago | parent

They wanted "full stack", so they found hires with 1/10th of an education in each of 10 different fields.

The boss class are rich because they're smart. /s

greenavocado 31 minutes ago | parent

> 1/10th of an education in each of 10 different fields combined FTFY

0c3ca83 29 minutes ago | parent

But they're cheap 10x engineers.

NooneAtAll3 50 minutes ago | parent

"accidentally"

I feel paranoid enough now to blame ai companies to try to induce panic and proclaim "buy our product to save yourself"

pelagicAustral 49 minutes ago | parent

Agree, wild stretch to accidentally send this loot to a mailing list.

ReDress 17 minutes ago | parent

To be honest and fair, in this situation I don't believe this is something accidental.

It probably just happens that the security concerns at ZDI don't match the security concerns at Linux(the vendor).

So, it turns out that this vendor is difficult to work with ....

I mean - heh

ReDress 46 minutes ago | parent

I'm not surprised because the disclosure process of https://hackerone.com is completely and openly public.

But they have also disabled Linux as one of the products that they work with.

ototot 45 minutes ago | parent

are those posted by AI?

extraextra 42 minutes ago | parent

What an entertaining season in the simulation

dayofthedaleks 41 minutes ago | parent

The headline should include Trend Micro's name for shaming purposes. Amatuerish.

wongarsu 30 minutes ago | parent

Doesn't the Linux kernel encourage reporting on the public mailing list for kernel vulnerabilities that were found using AI? If I remember correctly they introduced that policy after the security mailing list got swamped with multiple reports for the same vulnerabilities

lynndotpy 30 minutes ago | parent

Still bleary eyed, but: Most severe ones are in SMB and KSMBD, which apparently have implementations in kernel space. I think this doesn't impact anyone not using KMB.

Others are LPEs, but two have been deleted by now, so can't be sure of the details.

TrendMicro's site opens up with a big big "Advancing AI-Native Security with Anthropic". Which checks out I guess.

jumperabg 13 minutes ago | parent

Finally the last vulnerabilities of the year.

fguerraz 4 minutes ago | parent

Can we kick SMB implementations out of the kernel please? If not, can we please get PHP mainlined in the kernel?