News for hackers. Stuff that matters.

A comment on Local privilege escalation vulnerabilities in Linux. Parent comment

Re:Local privilege escalation vulnerabilities in Linux by 0x00cl on Wednesday November 04, 2026 @08:58PM (#50374127)
I'm going to assume that there was "old" code that caused LPE vulnerabilities, but, The Linux Foundation have their own project Sashiko (https://sashiko.dev/), which analyzes each commit to the Linux Kernel for bugs and vulnerabilities using Googles models, my question is then, how many of the vulnerabilities you found were also caught by Sashiko?
[ Parent | on HN ]
Re:Local privilege escalation vulnerabilities in Linux by paxy on Wednesday November 04, 2026 @10:08PM (#50374660)
If Sashiko had found them then they wouldn't have been merged, so my guess is 0
[ Parent | on HN ]
Re:Local privilege escalation vulnerabilities in Linux by 0x00cl on Thursday November 05, 2026 @03:28AM (#50376638)
That's fair, but I guess the question is whether analyzing each commit can find vulnerabilities or it takes more than that (aside from using Google models). It is possible they might have dismissed Sashiko review because they thought it wasn't possible or didn't make sense.

Then the question becomes how many vulnerabilities Sashiko didn't catch (If they use/review Sashikos review)

[ Parent | on HN ]