[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <agVAxc-23YmNDzN8@netmeister.org>
Date: Wed, 13 May 2026 23:25:57 -0400
From: Jan Schaumann <jschauma@...meister.org>
To: oss-security@...ts.openwall.com
Subject: Re: Linux kernel LPE ("fragnesia", copyfail 3.0)
Solar Designer <solar@...nwall.com> wrote:
> On Thu, May 14, 2026 at 12:45:31AM +0900, Hyunwoo Kim wrote:
> > This vulnerability is a path that was accidentally activated _after_ the introduction of f4c50a4034e6 (2026-05-05), the patch for CVE-2026-43284 in the Dirty Frag chain.
> >
> > In other words, the effective vulnerability window is from f4c50a4034e6 (2026-05-05) to upstream -- approximately 9 days.
https://github.com/v12-security/pocs/tree/main/fragnesia
claims "All versions affected by dirtyfrag are
affected." and simultaneously "Any versions without
this patch:
https://lists.openwall.net/netdev/2026/05/13/79, so
Linux kernels before May 13 2026."
This reads to me as different from Hyunwoo's analysis.
Is there consensus on which is correct?
> On Wed, May 13, 2026 at 11:59:37AM +0100, Sam James wrote:
> > v12-security have disclosed "Fragnesia" [0]. Quoting their disclosure:
Am I correct in my understanding that this
"disclosure" was done solely by dropping the code on
GitHub, with no advance notification to the Linux
kernel or distros? Does that seem reasonable because
it's adjacent to the vulnerability whose coattails it
rides?
I understand that the realistic utility of embargoes
is currently shrinking dramatically, but this "drop it
while it's hot" approach to seemingly promote yet
another AI vulnerability discovery service is a trend
I can't abide.
-Jan
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
