Local privilege escalation vulnerabilities in Linux

Re:Local privilege escalation vulnerabilities in Linux by za_creature on Thursday November 05, 2026 @05:20AM (#50377446)

> even the simplest code, e.g. cat & find, had bugs and buffer overflows.

Did you report these findings? Because I think those bugs are live Canada, with your girlfriend.

[ Parent | on HN ]

Re:Local privilege escalation vulnerabilities in Linux by thomashabets2 on Thursday November 05, 2026 @08:13AM (#50378690)

Sigh.

Yes, I reported some of them. Some got fixed, some got ignored. You can search my name on openbsd-tech

I found more, but the ratio of ignored to fixed is too high to bother.

Years ago I also fixed bugs in the MPLS implementation. Like bugs I found immediately upon using the feature.

[ Parent | on HN ]

Re:Local privilege escalation vulnerabilities in Linux by za_creature on Thursday November 05, 2026 @11:49AM (#50381375)

I can't find the cat bug, mind linking to it for my peace of mind?

The find bug was merged the next day from what I could tell.

[ Parent | on HN ]

Re:Local privilege escalation vulnerabilities in Linux by thomashabets2 on Thursday November 05, 2026 @01:54PM (#50382894)

Seems I misremembered. Two reported bugs in find, but didn't want to get yelled at (again) so did not report the cat one. Cat -n is not in any standard, but at least in my opinion there's no way openbsd's behaviour on "cat -n a b" when "a" doesn't end in a newline is desired.

Yup, they did merge both find bugs.

The ignored ones seem to be my reported doas bug (not security problem, but directly contradicts manage about a config keyword detail) and efiboot.

IIRC the latter bug was like... this can never have worked.

I just checked the GitHub mirror, and those two are still not picked up.

[ Parent | on HN ]