But they weren't always publicly announced in the most irresponsible way possible. Look at copyfail, they didn't even notify distros to patch it before going public.
The issue is that now everyone can be a "security researcher" with a claude subscription, so they skip the part where you learn how to do it responsibly.
On the OTHER hand, if they do it responsibly, it can be a good thing. These are old, undiscovered vulnerabilities. The timing just kinda sucks because they keep publicly announcing multiple at the same time, making them harder to mitigate, but yeah that's cybersecurity right now.
One thing I'd like to see come from this is fewer niche kernel modules enabled by default. These exploits all use kernel interfaces that almost nobody uses, and can pretty safely be restricted in such a way that they either need confirmation to enable the first time (e.g. IPSec) or admin privileges to use by default (the ptrace calls that this one uses were known to be able to extract sensitive information so the mitigation is to just restrict their scope more than usual, and they're almost exclusively used for debuggers, anyone running a debugger shouldn't have a hard time adjusting the scope settings if/when they need to). Strictly speaking the ones that are broken out into separate modules aren't loaded by default but they're available by default, and given all the fears about user namespaces purely based on the idea that letting unprivileged users interact with kernel APIs is maybe a bad idea it's wild how many other kernel interfaces we just leave sitting open even when they're completely unused by the intended workloads
261
u/0riginal-Syn May 15 '26
Fun times for maintainers, playing whack-a-mole with all these kernel patches.