In what universe is selecting text in a terminal an "idiosyncratic user interaction" ?

You have to select exactly the right text, and that text will never look like "select this right now" --- if you've seen the characters we're talking about, it's like Zalgo text. Selection in an xterm is not the ordinary response to these strings.

This is a little like Clickjacking, where you'd expect a bounty hunter to come at you with "this very severe bug can be triggered simply by clicking", and you respond "well, we should fix that, but users never click in those places, so we're going to send you a t-shirt" and the bounty hunter responds "no, clicking is a fundamental user interaction, you should send me $5000".

And my point isn't even that this is a dumb bug (certainly, it's not as dumb as CJ usually is). It's that there is absolutely no fucking way it is a 9.6 on a 10.0 scale of severity. Shellshock, ffs, has the same NVD CVSS as this bug. Shellshock doesn't even care what terminal you're using.

>if you've seen the characters we're talking about, it's like Zalgo text. Selection in an xterm is not the ordinary response to these strings.

Yeah, with all due respect, you're not in touch with what ordinary responses are.

When people see zalgo like the infamous SO regex post, selecting it is the first thing they do.

That's what the bug bounty person says about their CJ bug. Meanwhile: NVD has given this the same score as Shellshock, which is dispositive of how bad CVSS is.

In fact, it is dispositive about exactly the opposite. But let's agree to disagree.

Shellshock was a universal RCE in anything that ran bash with control over environment variables --- which included a huge subset of all web services, often on any code path in which bash was just incidentally run. Not only that, but the vulnerability was exploited in bash; it wasn't memory corruption, there were no system-specific offsets to limit the scope of exploits, nor could you have preemptively hardened a system against it with ASLR or W^X.

NVD gives Shellshock the same CVSS as this vulnerability, which requires a user in xterm to see a bunch of international UTF-8 characters and select them precisely enough to make a memory corruption exploit encoded in those characters run --- and do that without any feedback from the target, because what you're interacting with here is xterm, not a network service you can talk directly to, or a Javascript runtime.

I do not agree to disagree. The CVSS here is simply wrong.

I completely agree with that. I think it’s still a useful shorthand for “hey, you might want to take a look at this one”.

Once again: my point is that it is the opposite, because you can make lots of vulnerabilities read out this way even if they're not at all urgent --- and the opposite thing is true, very severe vulnerabilities can also get surprisingly low scores.

CVSS is literally a Ouija board. I'm not just calling it that because it's unreliable or based on superstition. I'm saying that the process of arriving at a CVSS score is Ouija-like: you fill out a calculator or something, get a score that has no relation to your intuition of the severity of the vulnerability, and start applying small bits of pressure here and there to land on the score you know the vulnerability should land on. In fact: if you don't do that, you get exceptionally dumb CVSS scores for everything. It's a mess.

If you want to call out the severity of a vulnerability, you should do so with objective facts. "Remote code execution" is a good tip-off. "CVSS 9.6" is not.

I understand what you’re saying and generally agree. We get incoming bug bounty reports like “drop everything, here’s a 9.8 you need to fix right now!” that turns out be a misunderstanding.

But in the case where multiple vendors have scores like:

- Amazon: Important (https://alas.aws.amazon.com/AL2/ALAS-2021-1619.html)

- Ubuntu: 9.8 (https://ubuntu.com/security/CVE-2021-27135)

- Red Hat: 9.6 (https://access.redhat.com/security/cve/CVE-2021-27135)

…it starts to look like there’s consensus that not only is there an RCE, but it’s really easy to exploit. I think that’s where CVSS starts to come in handy. An RCE is bad, but one that’s trivial to actually use is extra bad. And yes, CVSS absolutely has some Ouija properties, but it’s the most commonly used metric I’ve seen for communicating how bad a vulnerability actually is. In this case, it wasn’t just the reporter who said it was bad but all the affected vendors agreeing with them.

Ubuntu is just taking the score from NVD. Redhat has applied the first Ouija input to it, adjusting it to "user interaction required". That changed the score from a 9.8 --- 0.2 points from the maximum possible CVSS score --- all the way down to... 9.6.

I can't think of a better illustration of how bad CVSS is.

Once again: my point isn't that the vulnerability is unimportant (though: it's not nearly as important as it likely seems) or that it doesn't belong on the HN front page (it is a very, very funny vulnerability). It's simply that we should not be editorializing CVSS scores into titles, or taking CVSS scores seriously when they occur organically in titles.

CVSS is very, very bad. It is the CISSP of security metrics.

That ending made me LOL. Well phrased.

I had to look it up: Certified Information Systems Security Professional