60
Several Linux Kernel Vulnerabilities Accidentally Posted To Public Kernel Mailing List (www.phoronix.com)
submitted 6 hours ago by to c/linux@programming.dev
14 comments fedilink hide all child comments

all 14 comments

sorted by: hot top controversial new old
[–] 1 point 24 minutes ago

Can I at least get some sleep please? Jeez... How many more fires I will have to put out this week?

  • permalink
  • fedilink
  • source
    •
    [–] 16 points 4 hours ago* (3 children)

    I only program in Excel conditional statements and I never get these vulnerabilities.

    Excel is therefore proven the most secure coding language, and like a Swiss pocket knife it doubles as an industrial grade database.

    (pats hood) Listen to that xls(x) purrr..

    Oh no sorry I can't show you right now, I had to open my spreadsheet so it'll be a few hours til I can start work.

  • permalink
  • fedilink
  • source
  • hideshow 3 child comments
    •
  • [–] 6 points 2 hours ago* (last edited 2 hours ago) (2 children)

    https://youtube.com/watch?v=IrVA1BBHFHw&ra=m

    Oh, sorry, I couldn’t hear you over this BITCHING ROLLER COASTER BUILT IN EXCEL

    I got sent an excel file with a full volumetric heat diffusion simulation once, and it was most impressive thing until I heard about this roller coaster

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
    • [–] 2 points 3 hours ago

    At least it sounds like the 9.0 ones only affect systems that are running SMB Direct, which sounds like a pretty niche setup

  • permalink
  • fedilink
  • source
    •
    [–] 3 points 4 hours ago

    TIL KSMBD exists... and seemingly with some very strange priorities what gets implemented.

  • permalink
  • fedilink
  • source
    •
    [–] 4 points 5 hours ago (6 children)

    SMB Direct remote code execution vulnerability due to integer underflow.

    It's a day ending in 'y' and we've found another RCE that wouldn't exist in a modern language designed to catch things like integer under/overflow.

  • permalink
  • fedilink
  • source
  • hideshow 6 child comments
    •
  • [–] 7 points 5 hours ago (3 children)

    Yes, we get it, you like rust.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 5 points 4 hours ago* (2 children)

    I mean yes, I do, given safe Rust inherently fixes seemingly every exploit listed in this article:

    • RCE from integer overflow (not possible by default in Rust, CVSS 9.0)
    • RCE from a race condition (not possible in safe Rust, CVSS 9.0)
    • An exploit of a buffer copy
    • An out-of-bounds write leading to local privilege escalation
    • Using an uninitialized resource
    • TCP query stack buffer overflow leading to local privilege escalation

    I feel like it's the 1960s and I'm being told "we get it, you like seatbelts".

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [+] -7 points 4 hours ago (1 child)

    Yeah because the way you said it is extremely dick-ish and sounds like someone trying to push their preferred language onto others.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 11 points 3 hours ago*

    > "sounds like someone trying to push their preferred language onto others."

    > didn't even name Rust in the first comment

    I literally only talked about Rust when someone else mentioned it, because I'm not specifically talking about Rust.

    Whereas yes, Rust is relevant to the Linux kernel for obvious reasons (matching C's speed and being easily interoperable with it), I said "a modern language" because I'm talking generally about the use of old, unsafe languages and major exploits surrounding problems that modern languages fix cropping up every 5 seconds.

    I'm not going to police my own tone about what are clearly negligent engineering practices. SWE should be treated with the same level of scrutiny as other engineering fields when its poor, outdated practices are constantly causing accelerating worldwide damage.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 3 points 5 hours ago (1 child)

    Start stroking your keys on your keyboard in said language and fix the RCE yourself instead of typing stuff here that contributes to nothing.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •