Re:Dirtyfrag: Universal Linux LPE
by flumpcakes on Thursday May 07, 2026 @04:13PM
(#48054264)
7 days from disclosure to publishing a how-to guide to get root to the entire planet doesn't scream "responsible" disclosure to me.
[ Parent
| on HN ]
Its not the reporter's fault that other people broke the embargo.
They don't have to publish a working exploit as soon as the embargo is broken, though.
Re:Dirtyfrag: Universal Linux LPE
by throw0101c on Thursday May 07, 2026 @05:24PM
(#48055265)
Perhaps, but if the exploit code is published folks can double-check that they implemented the mitigations properly.
If there's no PoC, how can you really be sure?
Re:Dirtyfrag: Universal Linux LPE
by john_strinlai on Thursday May 07, 2026 @05:05PM
(#48055004)
anyone who will use the exploit maliciously will immediately and trivially be able to create a working exploit.
Why not? There has already been a working exploit floating around, at least now it comes from an authoritative source.
Re:Dirtyfrag: Universal Linux LPE
by staticassertion on Thursday May 07, 2026 @10:29PM
(#48057773)
An exploit was already published.
The third party posted an exploit.
My immediate reaction was the same.
But this is very similar to Copy Fail, and I'm assuming there was an assumption that others might also discover this soon as well. Hence the urgency.
At least that's my charitable interpretation.
Re:Dirtyfrag: Universal Linux LPE
by lofaszvanitt on Thursday May 07, 2026 @05:14PM
(#48055151)
WTF cares? Publish them without disclosure is the true way, otherwise noone would care about security and your data.