Thread

1. embedding-shape · 1790902178 · focus · HN ↗

   "Several" feels a bit of an understatement, there are 1313 CVEs listed on that page!

   Wonder how many of these NSA and others been sitting on, for how long and how many are still there? I guess the silver lining with the aixplosion of CVEs is that software eventually will get more secure.

   1. zahlman · 1790934576 · focus · HN ↗

      I checked out the last (highest-numbered) one just as a quick sanity check:

      > In the Linux kernel, the following vulnerability has been resolved:

      > usb: typec: ucsi: unregister debugfs entries on teardown

      > ucsi_register() creates per-instance debugfs entries, but ucsi_unregister() keeps them around until ucsi_destroy().

      > Drivers like ucsi_glink that unregister/register the same UCSI instance across remoteproc restart then try to create an already existing debugfs directory and log:

      > debugfs: 'pmic_glink.ucsi.0' already exists in 'ucsi'

      > Unregister debugfs entries as part of ucsi_unregister(), and clear ucsi->debugfs after freeing it so repeated unregister paths remain safe.

      I'm going to need someone to explain how that could possibly become a "vulnerability".

      1. brabel · 1790941151 · focus · HN ↗

         All bugs in the kernel are assumed to be vulnerabilities as many others in this thread have been trying to explain.

Unofficial Hacker News client; not affiliated with Y Combinator.