12 New CVEs in X.Org Server and XWayland

5 days ago by LinuxNation to c/linux

Twelve new vulnerabilities in X.Org Server and XWayland, uncovered by Trend Micro's Zero Day Initiative with the help of AI, are fixed in xorg-server 21.1.25 and xwayland 24.1.14.

lambalicious 11 points 5 days ago

uncovered with the help of AI

So, how many of those are actually real?

save

path: 0 26219414, hotness: undefined, score: 11, children: 9

FauxLiving 6 points 5 days ago

Twelve of them.

save

path: 0 26219414 26221750, hotness: undefined, score: 6, children: 0

42yeah 4 points 5 days ago

As much as I advocate for human written code, we should also acknowledge that AI has gotten way more competent recently, esp. on the coding front. I think security and vulnerability scanning, (maybe together with code review?), should be the few valid uses of AI.

save

path: 0 26219414 26222968, hotness: undefined, score: 4, children: 2

42yeah 2 points 5 days ago

(And obviously, the human using the AI should confirm the vulnerabilities themselves first before handing it to the maintainers)

save

path: 0 26219414 26222968 26223188, hotness: undefined, score: 2, children: 1

lambalicious -4 points 4 days ago

(Oh how cutely innocent you are...)

save

path: 0 26219414 26222968 26223188 26230060, hotness: undefined, score: -4, children: 0

fodor 4 points 5 days ago

Also, remember that "AI" means scripts in this context. We've used scripts to scan for vulnerabilities for decades. That alone is neither new nor scary.

There are serions issues with AI, including how you define it, but scanning code for weak points itself, on its own, is not one. It's what you do with that data that matters.

save

path: 0 26219414 26221873, hotness: undefined, score: 4, children: 3

FauxLiving 2 points 5 days ago

Exactly.

AI is bad at a lot of things, but bug hunting isn't one of them. It still requires an expert human to be effective but it lets them review a lot more code.

save

path: 0 26219414 26221873 26222897, hotness: undefined, score: 2, children: 1

ragas 2 points 3 days ago

I've had mixed results. Sometimes it points me directly to the issue and sometimes it is just dumb as a rock.

save

path: 0 26219414 26221873 26222897 26258628, hotness: undefined, score: 2, children: 0

user_123 2 points 4 days ago

Yes, but ai gives a lot of false positives. And when you see articles like this its hard to know if its a verified vurnebility or a potential vurnebility.

It was kind of the same with the old vurnebility test tools

save

path: 0 26219414 26221873 26228253, hotness: undefined, score: 2, children: 0

xxce2AAb 3 points 4 days ago

All of these, presumably. The question is how many issue reports the maintainers of those two projects had to wade through to find those relevant twelve. And whether that took more work than they would have had to expend to find those bugs themselves or not.

save

path: 0 26219414 26226370, hotness: undefined, score: 3, children: 0