Hacker News Reader

Comment by izacus | Hacker News Reader

Who demonstrated getting root with it? The last I've seen was "trust me bro".

Anthropic claims they have and they havn't been caught in a lie about this sort of thing yet. From a theoretical perspective, if a memory safety vulnerability in kernel network stack is exploitable, then root access would be the endgame so it fits.

Asked claude/haiku5.5 to review that cve against my server, docker images. Claude had passwordless ssh access to that server and no root access. It did the review, confirm that server has the volubility, asked me to ran a few sudo commands, give it the output. It asked me to run a command to disable mptcp option.

I then asked it to do complete cve reviews on the host server (U 26.04 was installed a few weeks back) and docker images on that server and update the security review and added a task to do daily check on ubuntu website on kernel security update.

EDIT: Just asked claude if it can write a patch and build a image on top and fixed the issue on my server. It said it can. And point out that it can apply the 2 lines patches https://github.com/torvalds/linux/commit/e3f33b0.patch and build a kernel image on this issue for me. FYI....

So it's indeed "trust me bro!".

What exactly do you expect them to do? Publish the exploit that can root a huge proportion of all linux servers?

Presumably they will publish it with sufficient fanfare once patches are applied widely enough.

Reply on news.ycombinator.com