The flip side to this coin that the article doesnāt really touch on, is the malicious actor, potentially state level, leveraging āAIā tools to find 0-day vulnerabilities
I donāt understand the technicalities of the find, but it does seem quite impressive that any LLM should be able to do this kind of analysis.
After years of people using AI filing bogus bug reports everywhere Iām not sure what this points to: AI getting better or hitting one by chance.
lemme put it another way ⦠AI isnāt going anywhere , and itās getting smarter.
let that sink in
Iāve seen no evidence of this when it comes to writing. The art it creates is also very obvious. Maybe other things. I know itās coming.
This is worth watching. Scary stuff! Sorry its probably UK only. But not difficult to find āelsewhereā
Given enough time, a monkey hitting a typewriter at random will almost surely reproduce the complete works of William Shakespeare.
To put it mildly, the notion that AI is āgetting smarterā is debatable.
What is less debatable is the fact that the pace of AIās development continues to fall far short of what the marketing and hype have been promising. Let that sink in.
The Internet has proved that wrong.
According to the article there is a use after free (UAF) , but the code shown immediately nulls the pointer.
According to all discussions I could find of this problem, nulling a pointer after the memory is freed is the proper way to deal with UAF. (Though apparently there also āsmart pointersā which are also billed as a solution.)[1,2,3]
I guess the problem here is that the pointer could be dereferenced after the call to free but before it is nulled?
I that case what mitigations can be applied? Unless there is some way to make free+null atomic it seems there is no simple fix and the code just needs to be rewritten so that sess->user is recycled in this way.
Can anyone with knowledge of C++ weigh in?
[1] https://cwe.mitre.org/data/definitions/416.html
[2] https://learn.snyk.io/lesson/use-after-free/
[3] https://expl0it32.medium.com/demystifying-use-after-free-vulnerabilities-a-deep-dive-into-memory-safety-issues-78ee7f8d44c2