4 ms·
This is amazing. Page says it works on RHEL 14.3, which doesn’t exist. Current RHEL is 10.x, this must’ve been done in a TARDIS.
by jzb 5mo ago
This is amazing. Page says it works on RHEL 14.3, which doesn’t exist. Current RHEL is 10.x, this must’ve been done in a TARDIS.
- rdtsc 5mo ago[flagged]
- deleted 5mo ago[deleted]
- tptacek 5mo agoI have no idea about this page, but Theori/Xint has a staff of veterans, they are a serious thing.
- rdtsc 5mo agoThe fact that they have no idea RHEL 14, probably the most well known enterprise distro, is not a thing, and yet they "directly verified on it" casts some doubt on seriousness.
- tptacek 5mo agoI don't know what to tell you. I'm sure you have them dead to rights on Linux distro knowledge reliability, but the exploit here is real, and the vulnerability researchers they have on staff are also real. Xint is not generally a slop factory. It's ironic that the one thing LLMs can't do reliably in this space is "write copy for humans" (I don't trust them for that either).
- deleted 5mo ago[deleted]
- JeremyNT 5mo agoHonestly I feel like a coding agent review would have caught this issue. I guess if you want to vibe-code your branded CVE web site it's not a bad idea to at least mash /review at the end. Kind of funny to do something impressive and then ignore the details on the presentation, but perhaps that's not uncommon for security researchers?
- deleted 5mo ago[deleted]
- stackghost 5mo agoIs it more likely they have no idea what version RHEL is on, or that it's just a typo?
- 0x0 5mo agoDropping a public exploit on github before distros have patches available isn't very cool, or is that just how veterans roll these days?
- akerl_ 5mo agoI don’t know if “cool” is the word I’d use, but there isn’t an established “right” way to disclose a vulnerability that you found outside of a contracted security review or other employment/contracting arrangement.
- tptacek 5mo agoThere is no one accepted set of norms on disclosure. Any strategy you take, someone will criticize.
- john_strinlai 5mo agomainline was patched a month ago
- bryanlarsen 5mo agoOn the same line it says kernel version 6.12.0-124.45.1.el10_1. Which is RHEL 10. This is the kind of typo that humans make -- the hard to type numbers are accurate because they're cut and pasted, but the "easy" numbers have errors because they're not cut and pasted.
- oskarkk 5mo ago14.3 seems to come from some Red Hat-specific GCC version, which can be reported as "gcc (GCC) 14.3.1 20250617 (Red Hat 14.3.1-2)". See these random examples I found by googling: https://github.com/anthropics/claude-code/issues/40741 https://github.com/anthropics/claude-code/issues/40741 (gcc version "Red Hat 14.3" included in system version at the bottom) https://docs.oracle.com/en/database/oracle/tuxedo/22/otxig/software-requirements-red-hat-enterprise-linux-10-64-bit.html https://docs.oracle.com/en/database/oracle/tuxedo/22/otxig/s...
- tylerni7 5mo agough sorry should be fixed. There was some scrambling to get more info together to explain the issue (and yes, obviously marketing), so there are some minor mistakes. Thanks for pointing it out!
- justinclift 5mo ago> obviously marketing Why marketing though?
- tylerni7 5mo agobecause we're a company and we want to make money to continue to fund cool research, and help our customers secure their software :)
- otterley 5mo agoI don't quibble with your wanting to make money, but you also need to invest some resources on fact-checking, proofreading, and editing your work. You can hire technical writers and marketing copy editors on an hourly basis as needed. LLMs aren't good enough yet to produce high-quality output on their own; and the results tend to read similarly, loaded with clichés and identical turns of phrase. (You're not alone in this, BTW; I don't mean to single you out.)
- Sohcahtoa82 5mo agoResume-driven development
- IgorPartola 5mo agoI would rather people who find this kind of stuff pad their resumes and get coolness points on HN than sell this exploit on the black market. But your priorities may be different and you might prefer they do the latter.
- 0x00cl 5mo ago
- tjbecker 5mo agohttps://x.com/i/status/2049687923814281351 https://x.com/i/status/2049687923814281351 > and yes, RHEL 14.3 doesn't exist We meant to say RHEL 10.1. Sorry for the confusion!