‹ BackHN Continuity

Thread

Several vulnerabilities have been discovered in the Linux kernel

576 points · 408 comments · luispa

  1. kalessin · · focus · HN ↗
    I thought the &quot;Security in the LLM age&quot; talk by Greg Kroah-Hartman published this week from Kernel Recipes was pretty interesting: <a href="https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=NnV_cWeoo5Q" rel="nofollow">https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=NnV_cWeoo5Q
    1. sashank_1509 · · focus · HN ↗
      Yeah it’s a great video (TLDR from the video)

      1. LLMs have high false positive rate. From mythos 79 vulnerabilities found in the Linux kernel, only a single digit were actual bugs and they were all obscure so don’t panic.

      2. What does obscure mean? I don’t really understand it, but many of the bugs have to do with custom network drivers or other custom drivers that are very specific to certain organizational setups, not a general Linux distro issue.

      3. He’s very frustrated with the high false positive rate mythos generates. Even after multiple rounds of adversarial review and prompting strats, he mentions it is &gt; 20% false positive rate, which wastes a lot of time. When some random user on the internet brings up a bug with an LLM it’s almost always fake, he even says just push back a few times claiming it’s not a bug to see if it’s a real bug (LLMs very quickly cave and “notice their mistake” etc)

      4. General observation on the useful bugs mythos finds. Chain multiple smaller bugs to see if you can get a bigger breakage. Mythos is really good at constructing these long convoluted chains that fuzzers miss.

      5. Go through recent bug fixes and check if similar bugs are hidden elsewhere in the codebase. Mythos is good at such pattern matching albeit with a high false positive rate.

      Final conclusion: don’t panic, the bugs are getting fixed, this is not as bad as the first fuzzer bug mania and will be fixed quicker, he estimates a year and we won’t see huge bug reports anymore.

      1. fwip · · focus · HN ↗
        &gt; push back a few times claiming it’s not a bug to see if it’s a real bug (LLMs very quickly cave and “notice their mistake” etc)

        I wonder how much more likely the LLM is to cave for a false-bug. There have been a number of times in my own (non-security) work that I&#x27;m told the LLM that it was wrong, it apologized and agreed, and then later that day I realized it was correct after all.

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.