AI security audit of FreeBSD kernel reveals 15 bugs including RCEs and a hypervisor escape
By
Calif
If you only eat one bagel today, this is the bagel.
Summary
An AI audit of FreeBSD uncovered 15 kernel bugs, including 3 remote code execution vulnerabilities, 5 local privilege escalation flaws, and 1 bhyve hypervisor escape. The article reflects on how critical internet infrastructure relies on volunteer-maintained open source projects like OpenSSH, and expresses gratitude toward these maintainers.
Key quotes
· 4 pulledSince we started this campaign of hacking the Internet with AI, we've learned something many of you already knew: the Internet runs on volunteers.
Projects that are critical to Internet security and culture are staffed by tiny groups of people, sometimes one person.
OpenSSH, which protects almost every remote shell on the Internet, is maintained by a small team led by a single Aussie (Hi Damien!).
We feel like we owe these maintainers something.
You might also wanna read
Security Analysis of FreeBSD Jail Isolation Vulnerabilities and Escape Techniques
Security researchers analyze the FreeBSD jail isolation mechanism, auditing the kernel's attack surface to identify vulnerabilities and deve
media.ccc.de·5mo agoFreeBSD security hardening: A sysadmin's guide to fixing poor default configurations
A critical analysis of FreeBSD's default security configurations, documenting specific hardening changes a sysadmin should make after a vani
OpenCode AI Coding Agent Hit with Critical Remote Code Execution Vulnerability
OpenCode, a popular open-source AI coding agent, was recently hit with a critical CVE (Common Vulnerabilities and Exposures) that allowed fo
johncodes.com·4mo agoFreeBSD Security Advisory: Local Privilege Escalation via execve() Affects All Supported Versions
FreeBSD released a security advisory (FreeBSD-SA-26:13.exec) addressing a local privilege escalation vulnerability via the execve() system c
Gentoo Linux addresses Copy Fail, Dirty Frag, and Fragnesia kernel privilege escalation vulnerabilities
The article reports on a series of recently discovered Linux kernel privilege escalation vulnerabilities — Copy Fail, Dirty Frag, and Fragne
gentoo.org·13d ago
AI Security Tools Find 50 Real Bugs in cURL Open-Source Project
A security researcher successfully used AI-based static application security testing (SAST) tools to identify 50 real bugs in the widely-use
etn.se·7mo ago