Seems to be found as a part of Patch The Planet [0] which is basically OpenAI giving model access and Trail of Bits using them to find vulnerabilities in OSS projects.<p>[0] <a href="https://openai.com/index/patch-the-planet/" rel="nofollow">https://openai.com/index/patch-the-planet/</a>
neat, i'm a big fan of trail of bits but apparently missed this announcement. here's their post: <a href="https://blog.trailofbits.com/2026/06/22/introducing-patch-the-planet/" rel="nofollow">https://blog.trailofbits.com/2026/06/22/introducing-patch-th...</a> and a summary of week 1: <a href="https://gist.github.com/patch-the-planet/69fd1aa925c8e73edea9e6e967043cbb" rel="nofollow">https://gist.github.com/patch-the-planet/69fd1aa925c8e73edea...</a>
Sidenote but... I read this on that link:<p>dnsmasq: Codex Security independently identified vulnerable patterns corresponding to four of the six dnsmasq CVEs later fixed in 2.92rel2: CVE-2026-4890 (opens in a new window), CVE-2026-4891 (opens in a new window), CVE-2026-4892 (opens in a new window), and CVE-2026-517<p>dnsmasq has had so many freaking security holes in 2025 and 2026 that atm I decided to just remove that thing from all my machines.
I would love to, but apparently its needed for libvirt.
"dnsmasq has had so many freaking security holes in 2025 and 2026 that atm I decided to just remove that thing from all my machines."<p>Would be nice if OpenWRT would stop including it by default
One bug found is a testament to the great diligence and culture around security of OpenBSD. Especially if you take into account the amount of resources they have been able to achieve this with.
+1<p>It is <i>also</i> a testament to solid engineering and attention to good security practices in general. These still work, also against fancy new AI attackers.<p>When sophisticated attacks become cheaper to run, maybe it will (finally) be cheaper to do more solid engineering instead of doing it quick and dirty and ending up in indefinite bug-squashing mode.
While I agree, OpenBSD also doesn't fully implement features/functionality.<p>If your operating system only does 20% of what another operating system can do, it's easier for you to have 80% less bugs.<p>That's not a knock, it's a design philosophy of OpenBSD (which is to do the minimal needed, and no more, in the most simplistic way).
That does not match my experience with obsd. It is not so much minimalism as they are not afraid to reinvent the wheel. A obsd install is full of services, more than most linux installs I have seen.<p>For example you can imagine my disappointment when I discovered what a pain in the ass it is to get a pflow producer working on linux after doing the first one on openbsd.
If they can provide only 20% of the functionality and only 1% of the bugs, that's a compelling trade-off for many use-cases! (and a bit closer to the reality IMHO)
Exactly, the entire AI industry has been trying to create an AI powered security arm race. I am not necessarily blaming them.<p>Hard to know how much has been thrown into this but I would bet a lot.<p>So far I have been very surprised we haven't been flooded by those type of announcements. If you look you will always find something and OpenBSD is the top price.
one bug is all it takes
In theory.<p>But real defenses are generally multi-layered. And in that context, a Swiss cheese slice with only one hole is still extremely valuable.
LPEs do need to be fixed, but for most people it's not a threat model they need to worry about.
this is a misconception<p>yes, most company settings don't run untrusted code, and OpenBSD is mostly used for servers not employee devices<p>but that doesn't mean LPEs aren't quite relevant, because they matter for pretty much everyone if combined with other vulnerabilities, like RCE, supply chain attack etc.<p>and while RCE are becoming less common, supply chain attacks have been increasingly more common
> Only two remote holes in the default install, in a heck of a long time!<p><a href="https://www.openbsd.org/" rel="nofollow">https://www.openbsd.org/</a><p><a href="https://en.wikipedia.org/wiki/OpenBSD#Security_record" rel="nofollow">https://en.wikipedia.org/wiki/OpenBSD#Security_record</a>
OpenBSD's security stance being the stuff of legend, I'm curious how many vulns have been found over the last couple months while the big model companies are flaunting their ability to find exploits. It'd be super cool to see it remain tiny.
According to <a href="https://openai.com/index/patch-the-planet/" rel="nofollow">https://openai.com/index/patch-the-planet/</a><p>Linux: 24 LPEs, plus many additional vulnerabilities.<p>OpenBSD: 1 LPE.<p>FreeBSD: 7 LPEs, plus many additional vulnerabilities.<p>Not sure what that says, though. Perhaps the models are more likely to find Linux issues because of the training.
I wonder how many of the Linux the LPEs are related to drivers, which I understand there are more of..
Or Linux development is significantly more active.
Linux LPEs have never been in short supply, even before the AI age.
It is quite possible that Linux is the bigger target so it gets more focus. Vulnerabilities there are generally considered more valuable and notable. It would be very difficult to use these numbers to get a meaningful "more secure" stance as there are tons of variables.
Linux also has a ton of extra functionality so I think you’d also have to do some adjustment for “as a user would I be at risk?” versus “can I be a user because it supports my needs?” Some of that would be unfavorable for many users (e.g. a Linux user who is exposed due to a network protocol or file system they’ll never use) but that’s certainly not true of every feature.
That cuts both ways, though. If the functionality is present by default but I'm not using it, that's just extra vulnerability surface. (Of course, if I <i>do</i> want that feature, then its absence is kinda a problem)
Linux also has a ton of bloat. Configuring your own kernel has become an exercise in frustration because documentation is worse "There is no help for this kernel option" and a lot of things are enabled "by default".
From a quick search, Linux kernel is ~40 million loc, freebsd ~9 million, openbsd ~3 million. Number of bugs compared to lines of code leaves FreeBSD looking worse than Linux.
If this is just counting the kernel, than Linux is probably a bigger target both i terms of current code size and the amount of churn in the codebase as things change over time. Some of the LPEs might (I've not checked) be in modules that are not commonly loaded, which mitigates their overall significance somewhat.<p>In the less likely even that this is counting what laymen would call Linux or BSD, i.e. both the kernel and common libraries & tools, then Linux definitely has a wider attack surface. Though some of that surface is shared as some userland parts are common to both.<p>As with your assessment, I'd agree that these flat numbers without looking for further context don't really give enough for a one-is-more-or-less-secure statement.
The commit logs over the last few months have highlighted when an issue was found by a program. They usually name the submitter and the tool.
I think of it more as their attention to quality in their code:<p>Given the 'quality' of most code, especially under commercial pressure, it's no surprise that much more effective tools will find many more vulnerabilities. Did OpenBSDs quality approach work in this respect?
A local escalation in BSD is still apparently worth a front page post here, so that seems pretty good.<p>I wonder why we don’t see more about local escalations in Windows. Of course, being closed source is a little bit of a barrier, but these tools can read assembly pretty well, right?
I’ve heard a couple people say that Microsoft has patched a record number of bugs internally this year so it might be the case that it’s simply more opaque because it’s initiated internally and doesn’t involve a public Git repo or a third-party researcher.
You don't hear about them because you're probably not paying attention to where all the Windows admins hang out. Nearly every single patch tuesday over the past couple of years has been an emergency race to get things patched as soon as you can, for both local and remote exploits.
> OpenBSD's security stance being the stuff of legend,<p>More so their marketing.
If this is a local privilege escalation to root, why can't I find anything on <a href="https://www.openbsd.org/security.html" rel="nofollow">https://www.openbsd.org/security.html</a> ?
Best guess, from the commit message alone[0]: It was fixed as a bug, at the time they didn't have evidence it could lead to LPE<p>The AI security tool then, retroactively discovered that it could have been used for LPE.<p>Again, just my guess I could be wrong.<p>[0] <a href="https://github.com/openbsd/src/commit/1957873d2063db11dab780eca75b5e629d1e838d" rel="nofollow">https://github.com/openbsd/src/commit/1957873d2063db11dab780...</a>
OpenBSD has a reputation for being... selective about what they admit is a security-relevant bug.
Can anyone find the mailing list thread on this topic (or does it not exist because @security are private mailing list)?<p>I did find another use-after-free bug from a couple months ago on the mailing list:<p><a href="https://marc.info/?t=177581065500002&r=1&w=2" rel="nofollow">https://marc.info/?t=177581065500002&r=1&w=2</a>
from the link:<p>sys/kern/sysv_sem.c in OpenBSD through 7.9 has a use-after-free allowing local privilege escalation to root. This is a context switch use-after-free after tsleep in sys_semget().
Would Rust have made this issue impossible by construction? I know Linus has spoken about Rust's promises about memory safety not being equivalently applicable in the kernel domain, so I would be curious to hear any kernel developer's perspectives.
I'm not a kernel developer but I <i>am</i> an embedded firmware engineer.<p>To be clear: <i>I like Rust.</i> It's great, I use it a lot. But, Rust's memory safety stuff can't really save you from the screwiness of ISRs. Here's a long-winded example:<p>ST has a nifty double-buffer DMA mode for their ADCs, so you can give the ADC two different buffers, it'll fill one, fire an IRQ, you catch the IRQ and handle the data, meanwhile, it's filling the other buffer, and the IRQ fires again, you handle the data in the other buffer, rinse, repeat.<p>This allows the ADC to run continuously, monotonically and at very high sample rates, without monopolizing CPU. It's really a terrific design. I used it for a DIY telephony project once to run continuous FFTs on several ADC channels at once.<p>This is all fun, but the architecture introduces synchronization issues that aren't immediately solvable within Rust's data model.<p>Okay, so I can't run the FFT from within the ISR, so I delegate that to a thread. Do I have the thread read the DMA buffer directly, and just pray that it does it fast enough that the ADC doesn't loop back around to that buffer until the thread is done?<p>Or, do I have the ISR copy the buffer into a queue, mitigating the memory corruption risk? Well that seems good, but how do I make the queue visible to both the ISR and the thread? The ISR takes no arguments, it's just an address the CPU jumps to when a thing happens. Thus, the queue has to be global, which means more unsafe blocks and more very un-idiomatic Rust.<p><i>side note: in my use case, it actually worked just fine with the thread reading straight from the DMA buffer, even with the risk of memory corruption. But you can imagine use cases where the risk would be more severe, like maybe decoding packets from a serial interface.</i>
Rust is designed to make this type of issue impossible, but that assumes that you can correctly encode object lifetimes in the kernel in a way that allows the compiler to check them.<p>So I would say that any easy answer like “this would not compile” would just be a guess, because you would want to know more of the particulars in order to answer this question.<p>I know that this is kind of a non-answer, but if you want to write a kernel in Rust you have to figure out boundaries for where unsafe {} are. In a kernel, there are probably large chunks of unsafe {} and the Rust compiler prevents certain bugs <i>outside</i> unsafe {} assuming there aren’t bugs inside unsafe {} that would prevent the type checker from doing its job correctly.
I would say that Rust has a good story here. The simple form of this wouldn't compile. So you are generally presented two options:<p>1. Slap a reference count on it.<p>2. Use `unsafe` to promise the compiler that your code is right.<p>I would say that 1 is a pretty good habit to have. It may open you to memory leaks if you aren't careful but those are much less bad than a use-after-free or other memory management issues. And of course the fact that this was the route the patch took is a good sign. I think this is a pretty good default option.<p>Now if performance is a major issue you may consider going to 2, so it is impossible to say "Rust would have prevented this" because if it was originally written in Rust this may have been the route taken. But I think it is still very valuable to make that an explicit choice and obvious to reviewers and readers.
This <i>is</i> the answer I think. The correctness of your safe code is dependent on the diligence of the unsafe code except for the most simple cases. A kernel is going to have a pretty high unsafe to safe ratio compared to most usermode apps.<p>This really gets to the core of what I think Rust is about, you can add compiler checked constraints to your APIs that your C and C++ code can't. It's up to you to use them effectively. Rust's ability to keep your safe code safe is a measure of the language, but also your architecture. The buck has to stop somewhere for the language to prove safety, Rust lets you decide rather than the language itself.
The Rust ownership model prevents use after free. This type of a bug would not compile.
Not necessarily. Rust safety relies on OS primitives and the error here is in an OS primitive itself (kernel semaphores).<p>Yes Rust is one language that can be widely deployed in systems programming and potentially avoid classes of memory and ownership errors. No it doesn’t magically solve all the problems. Saying “Rust would fix this” in a hypothetical situation where Rust existed in 1995 or OpenBSD was rewritten from scratch, ok, well maybe. As of today only research kernels and a very small fraction of Linux systems have been written in Rust when we are talking about kernels.<p>People without systems and embedded programming experience need to sit down.
You might not be able to express the ownership in the way that can be checked statically, so quite possibly this would then be downgraded to a runtime error (that could be handled with a panic)—but not undefined behavior.
I’m not an OS programmer and have been dabbling with OpenBSD’s code for fun. But the fact is that Rust kinda lacks flexibility. Most of the OS is dedicated to building a beautiful lie for programs to run happily, and that’s where C shine.<p>I shudder to think about the amount of work that it would take to convince the rust compiler that everything is all right. Most hardware interactions is “parse, don’t validate” which means you’ll be pinky-swearing to the compiler.<p>And for my cursory glances at the code, most structures are handled well, that it’s mostly logic bug (from bad data) instead of bad memory access (which can happen).
In practice you don't convince Rust that everything is right. You let it prove that most of the code is right and you promise it (via unsafe) that the rest is. Ideally these unsafe blocks would be carefully documented, reviewed and ideally enclosed in small modules that makes correctness easier to ascertain.<p>Rust is no panacea, but in my experience it is far easier to write memory safe code when the risky bits are discouraged and explicitly highlighted rather than every line of code being a possible risk. Humans are pretty bad at reviewing 100 lines of boring looking code (especially if this is one of dozens of patches this week) but much better (although by no means excellent at) reviewing 5 2-line unsafe blocks amongst 90 other lines of code.
I thought that parsing implied validation. Is this not the case?
I often refrain from commenting about meta-issues on HN, but I'm particularly annoyed by the downvotes on this question of mine. What is this forum for, if not for this exchange between makers? I've noticed downvotes on questions are an oft occuring pattern. I think the comments on HN should house more than self-contained absolute statements.
Blasphemy
[dead]
[dead]
Ah, it was too good to be true, BSD too is becoming rusty.. ahh, what's left?
I think it's important to point out that OpenBSD is not more secure than others, it's just that it's not widely adopted so no one really does audit it.
"'Nothing could have prevented this from happening,' say users of only language where this happens" comes to bite OpenBSD.
OpenBSD wouldn't say anything like that. They're well aware of the 40+ year old codebase's limitations, but accept it because they're not so stupid as to "rewrite it in <other language>" which will bring a million bugs.<p>They've innovated again and again in the security space and aggressively bring in new security features like pf, OpenSSH, W^X enforcement, pledge(), arc4random(), ASLR, so many other things.<p>Unlike, say, NPM, which can't even replicate existing packaging systems like yum or apt, and has been plagued with security flaws despite being built entirely out of a memory-safe language. Quite an achievement.
> aggressively bring in new security features like pf, OpenSSH, W^X enforcement, pledge(), arc4random(), ASLR, so many other things.<p>I'd say OpenSSH is a great tool, arc4random was great and pledge is interesting although doesn't do much for code that wasn't compiled with it (and they are still really lacking in ways to lock down apps for a 'security focused' OS), the rest is just their implementation of stuff that already existed not something they innovated.<p>Most of their reputation comes from a time when linux distros and windows had every service enabled and exposed by default, it just developed it's own momentum the way many myths do.
It's difficult to say if a kernel written in rust would not have similar vulnerabilites, because it would be impossible to build a kernel without significant amounts of `unsafe`.
Tell us you know nothing about kernel programming and trust stacks while you are at it.
I know a lot about kernel programming. and the last thing as I would ever suggest as being core to kernel programming is that is a specialized discipline that uses different rules and shouldn't be accessible to neophytes. its just code. sometimes the restrictions are unfamiliar, but there is nothing magic going on here.
The OpenBSD project was started in 1995, with ancestry going back further than that. Should they have first invented Rust? Or at what point do you suppose the decades-old codebase should have been completely rewritten?
Anybody know why the compiler didn't pick this up?
Oh, <i>hey</i>, a local-user-to-root exploit on OpenBSD. Cool! Those are <i>rare</i>, but not <i>unheard of</i>, unless you're talking about Windows or Linux, where you don't hear much about this bug class, just since it's common-as-rainfall.<p>Anyway... Does this mean OpenBSD is suddenly less interesting? Nope, it's still pretty much the best-understandable general-purpose OS, ready for your RiiR fork. So, still go for that! Burn a universe or two worth of tokens! For the planet!<p>Does this mean OpenBSD is suddenly less secure? Nah... Its <i>practical</i> security level was never <i>that</i> much higher than that of its nominal competitors, despite Theo's best attempts, the best of which were replicated elsewhere and majority of it went ignored. The first class counts as "innovations", the rest as "experiments" which, no matter what anyone thinks, is not the same as "failed innovations."<p>But I digress. Now, go and donate to OpenSSH (because I bet you typed <i>ssh</i> today, didn't you, you rascal?), publish your OxidizedBSD fork, or whatever. Just don't link to that "is OpenBSD secure?" site, because, well, <i>gauche</i>, dude(tte)!