Finally the last vulnerabilities of the year.
The headline should include Trend Micro's name for shaming purposes. Amatuerish.
Still bleary eyed, but: Most severe ones are in SMB and KSMBD, which apparently have implementations in kernel space. I think this doesn't impact anyone not using KMB.<p>Others are LPEs, but two have been deleted by now, so can't be sure of the details.<p>TrendMicro's site opens up with a big big "Advancing AI-Native Security with Anthropic". Which checks out I guess.
Doesn't the Linux kernel encourage reporting on the public mailing list for kernel vulnerabilities that were found using AI? If I remember correctly they introduced that policy after the security mailing list got swamped with multiple reports for the same vulnerabilities
I'm not surprised because the disclosure process of <a href="https://hackerone.com" rel="nofollow">https://hackerone.com</a> is completely and openly public.<p>But they have also disabled Linux as one of the products that they work with.
What an entertaining season in the simulation
It's being a great season, techsecurity-wise.
are those posted by AI?
"accidentally"<p>I feel paranoid enough now to blame ai companies to try to induce panic and proclaim "buy our product to save yourself"
To be honest and fair, in this situation I don't believe this is something accidental.<p>It probably just happens that the security concerns at ZDI don't match the security concerns at Linux(the vendor).<p>So, it turns out that this vendor is difficult to work with ....<p>I mean - heh
Agree, wild stretch to accidentally send this loot to a mailing list.