Finally this vulnerability is in public discussion, because both maintainers and security researchers do not know how to fix it correctly 💀
Timeline from our perspective:
April 2?: our under-development Agent researcher found the bug and try to determine if it is exploitable.
April 24: the agent made a working exp under the guide of a teammate
@yz_zhuang . LPE demo dropped.
April 28: the first patch dropped, crediting a security researcher for reporting it. However this patch DID NOT fix the bug.
May 17: the first patch was applied to mainline kernel. We also thought it was enough to make the bug unexploitable at the first glance with human eyes.
May 26: the second group of security researchers reported that the bug is still alive. they accidentally leaked the PoC to public mailing list so we then know the first patch is not working. They also sent the second patch on the same day. Again, everyone here thought the second patch killed the exploitability, but it DID NOT.
June 3: our agentic system evolved into a new stage and a teammate ask it to review the latest kernel for benchmarking. It reported this bug (again). We thought it is a false positive and told the agent “that is fixed bro” but it keeps saying “no it’s not fixed”.
June 4:
@yz_zhuang manually reviewed the agent’s output.
“ah shit, here we go again”.jpg
We reported the bug and sent our fix patch to the maintainer, hoping that it will solve this bug.
Several hour ago: the maintainer decide to made this public to discuss correct way to fix it. But then another developer said the proposed fix also DID NOT working 💀 see that v4 tag in the mailing list?
Thoughts? The LPE demo was dropped before the phenomenal “copy fail” wave. At the time, many people said to us it was “fake and bullshit”, simply because we didn’t publish the PoC/exploit before the vulnerability was patched? 🤡 The rules of the game have evolved rapidly over those days.
If I were
@AnthropicAI , I’d advertise it like this: “Our AI agent system discovered a critical vulnerability in Linux kernel that neither human maintainers nor hackers knew how to fix.”
But as someone who actually works in this field, I’m concerned about the chaotic state of OSS, yet no one knows how to improve it. 🫠