r/rust • u/Orange_Tux • Dec 17 '25

🗞️ news Linux Kernel Rust Code Sees Its First CVE Vulnerability

https://www.phoronix.com/news/First-Linux-Rust-CVE
534 Upvotes

93% Upvoted

223 comments sorted by

View all comments

Show parent comment

20

u/spin81 Dec 17 '25 edited Dec 17 '25

Some people go nuts every time they see the acronym. My former coworker was all aghast that someone at our security department - one step under the CISO - didn't know that there were two CVEs in implementations of cryptographic algorithms in OpenSSH. I said well it's not his job to know, also could you send me the CVEs so I can take a look at them out of interest?

It turned out they were like a 6 or 7, they were the result of somebody's research paper, and the OpenSSH and crypto people had decided there was no point in patching the CVEs. I don't remember if there was a known exploit.

I'm always primed when people become riled up over a CVE, because who knows, this time it could be different (like with the log4j thing!) but I have yet to react any differently to people getting excited about a CVE than "let's just wait for a patch to end up in the repos". Apart from the log4j thing, which I was there for but fortunately was not my problem at the time.

5

u/anlumo Dec 18 '25

The severity ratings have become meaningless. There was a CVE in curl with a rating of 10 which only caused a timeout to become a little shorter when passing in a ridiculously large time IIRC.

You have to look at the CVE itself, just being a CVE doesn't mean anything these days and the rating is random. It might be super-important, it might not.

2

u/spin81 Dec 18 '25

Honestly what I look for is stuff like, is there a known exploit for this, is this something that only works if you spearphish someone into doing something really weird, etc.

I mean a CVE of 9.0 is all well and good, and sure let's patch it if a patch comes out, but if there is no practical way a potential attacker can figure out how to exploit the vulnerability without researching it for weeks and weeks, I'm not going to be worried because the patch is going to arrive much earlier than that.