Arthur Besse@lemmy.ml to linuxmemes@lemmy.worldEnglish · 1 month agoSeveral vulnerabilitieslemmy.mlimagemessage-square35fedilinkarrow-up1385
arrow-up1385imageSeveral vulnerabilitieslemmy.mlArthur Besse@lemmy.ml to linuxmemes@lemmy.worldEnglish · 1 month agomessage-square35fedilink
minus-squareslazer2au@lemmy.worldlinkfedilinkEnglisharrow-up108·1 month agoBut how many of those are actual problems though?
minus-squaretruthfultemporarily@feddit.orglinkfedilinkarrow-up111·1 month agoTo add, pretty much any kernel bug gets a CVE because everything wrong in the kernel could theoretically be abused.
minus-squareslazer2au@lemmy.worldlinkfedilinkEnglisharrow-up38·1 month agoBut there is a difference between an unauthenticated bug and a bug requiring an authenticated user getting some deserialised data.
minus-squaretruthfultemporarily@feddit.orglinkfedilinkarrow-up26·1 month agoYes, hence why you would have to check the CVSS of all of those.
minus-squareklankin@piefed.calinkfedilinkEnglisharrow-up15·1 month agoAnd they just changed the CVE rules to include non-exploitable bugs too. My theory is its to pump AI ‘discoveries’ numbers
minus-squareAnAmericanPotato@programming.devlinkfedilinkEnglisharrow-up67·1 month agoMost of them are just crashing bugs. Worth fixing but you don’t need to panic. If anyone exploits them, then A) you’ll know about it, and B) they won’t get away with anything sensitive.
minus-squarebobtimus_prime@feddit.orglinkfedilinkarrow-up75·1 month agoNo need to panic? Tell that the kernel! :D
minus-squareSeductiveTortoise@piefed.sociallinkfedilinkEnglisharrow-up6·1 month agoThe kernel is really anxious though, panics all the time.
minus-squaresmeenz@lemmy.nzlinkfedilinkarrow-up7·1 month agoBut crashing bugs are good for denial of service.
But how many of those are actual problems though?
To add, pretty much any kernel bug gets a CVE because everything wrong in the kernel could theoretically be abused.
But there is a difference between an unauthenticated bug and a bug requiring an authenticated user getting some deserialised data.
Yes, hence why you would have to check the CVSS of all of those.
And they just changed the CVE rules to include non-exploitable bugs too.
My theory is its to pump AI ‘discoveries’ numbers
Most of them are just crashing bugs. Worth fixing but you don’t need to panic. If anyone exploits them, then A) you’ll know about it, and B) they won’t get away with anything sensitive.
No need to panic? Tell that the kernel! :D
The kernel is really anxious though, panics all the time.
But crashing bugs are good for denial of service.