[jdw64]

I'm going through each one, and it's fascinating to see things like this. The UAF principle in c-ares is really interesting.

The problem ultimately came from not being able to prevent stale pointers. The attack works by figuring out the size of the stale pointer, then spraying memory with data of the same size, and finally achieving RCE (Remote Code Execution). How do people even come up with ideas like this?

[jdw64]

But do people actually find these vulnerabilities on their own, or are they using LLMs? I was curious about how these vulnerabilities work, so I tried asking my dear friend Mr. CLAUDE, but he immediately threw an error and ended the session because it was a cybersecurity question. Enterprise APIs block even the analysis itself, so it's amazing that people can actually pull this off in practice.

[nicce]

People have always used tools. Some people have better tools than others. I guess the line is thin whether they found on their own or not.

[raesene9]

If you want to chat with Claude about this, I'd recommend using Opus 4.6. IME it's happy to talk about (and even write) PoC exploits

[lacoolj]

I imagine this is a large open model like GLM5.2 etc

[jeffbee]

le sigh, c-ares. Very predictable outcome. If you ever find yourself entertaining the idea that you will simply write non-blocking network protocol stacks in C with manual lifetime management, slap yourself. It doesn't matter if you think you are a super genius of unimpeachable taste. The job is impossible.

[jdw64]

Thank goodness I use a GC language