OpenAI Finds 948 Local Privilege Escalation Bugs in the Linux Kernel
(www.phoronix.com)
Arthur Besse
Linuxcross-posted from: https://lemmy.bestiver.se/post/1434334
I do not trust AI. We've seen too many mishaps from it. That technology is too early for us to truly comprehend. And now... AI is finding all sort of things wrong with Linux which has been running darn near perfect for how many years now not counting system upgrades over hat is. Then again...I'm no programmer so I could be out in left field.
Pretty much finding these kind of errors ARE what vibecoding is good for, AI is pretty good at repetitive tasks like reimplementations,de/recompilations and similar which needs dinamic automation,cybersecurity is one of those matters where AI is pretty good at.
If anybody is interested: distros like Secureblue and Kicksecure (and Kicksecure-based ones like Whonix) reduce attack surface by disabling a bunch of kernel modules, and further harden the kernel via sysctl settings and kernel arguments. Secureblue also sends a notification whenever a system update fixes a vulnerability.
https://secureblue.dev/features
https://www.kicksecure.com/#security
Something else AI's ruining...
Something else AI’s ruining…
can you explain what you mean by this? are they ruining linux by revealing its bugs at a much faster rate? or ruining the security research field by depriving researchers of the challenge and enjoyment of finding these bugs themselves?
repeating myself from a previous thread: of all the things i hate about LLMs, getting vulnerabilities in important software like linux discovered and fixed is not one of them
(although, as i said elsewhere in this thread, i find it unlikely that openai is actually disclosing all of the bugs they find 😬)
no they didn't.
what do you mean?
948 is an absurd number to bugs to find at one time. i bet most of them are fake. i've seen the "bugs" AI likes to find
Tell me you haven't read the article without telling me you haven't read the article.
I haven't read the article.
If you have ever actually seen the discovery process, you'll understand that bugs and rce's don't just popup on a list from a computer. Sure, you can generate a list of places to start testing, but each of those has to be validated, reproduced, documented and understood before it's confirmed. It's not just the discovery of a starting point that constitutes an rce or other vuln, there's a ton of work that needs to be done by humans also.
So a few bad ones in the news? Sure. A list of 1500 non-validated rces? I'm not holding my breath.
You really have to think critically and let go of the "hacker" sensationalism in infosec, it's easy to fall into.
Sure, you can generate a list of places to start testing, but each of those has to be validated, reproduced, documented and understood before it’s confirmed
i guess you didn't actually read the blog post this article links to? The number in the headline (948) is the number of LPE bugs which they say they validated and reproduced and developed exploits (and patches) for.
I did. The article is scant, and the source report is everything bad about ai in the vuln world; high drama, low info. LPEs are not RCEs!
And we don't know what the exploits are. If it's a bunch of local jvm consoles or vi escapes into shell where it's like "oh this could give you root!", that's not super useful without knowing if it's a dumb initial config or an actual use-after-free or other memory exploit.
That's why we don't classify manufacturers with bad/no default creds as CVEs, that's just bad
Like I said, there is a lot of work to do before these become legit, and it almost certainly won't be 958 exploits after actual professionals review them properly.
And again, stop taking OpenAI at their word about security.
The amount of people who will speak confidently without knowing the full picture is astounding.
Discovering nearly one thousand local privilege escalation vulnerabilities consumed $1.2 million USD in API credits.
😅
sudo make me a sandwich
makes sandwich
oh my god
How can you talk? You're a sandwich! Clearly these bugs run deeper than we thought...
Ah, I’ve missed cuil theory
Where there is no thought, there is always deeper...
it's a bit odd how openai's blog post makes it sound like security bugs in Linux fall in two categories, info leak and local privilege escalation. i would guess that they probably did also ask their model to find some RCEs, but they're selling those to exploit vendors (or perhaps to intelligence agencies directly?) rather than blogging about fixing them.
That's terrifying holy shit
