Hacker News Reader

Comment by uvesten | Hacker News Reader

Is this a remote exploit? The NIST page seems to say so.

Looking at the reproducer (in the kernel commit message for the fix), this is a PE. Unless some software allows a remote user to control the issuing of these calls (seems unlikely).

I'm waiting for the day where there's one reliable place in the world where someone can look at info about a vulnerability and see very important and basic information like this. I think the interesting technical discussions for security experts get mixed in with the useful executive summary for the rest of us.

Remember when Intel ME bugs started coming out and we all had to go to Hacker News and trade rumors to figure out what was really going on?

I do try to get it right or the Red Hat affected cve pages.

https://access.redhat.com/security/cve/cve-2019-8912

The problem is one can only really talk about CVE's within the context of the product, perhaps a global CVE wiki /discussion page that can have edits/discussion would be a useful resource.

> Attack Vector: Local

Very good, gets right to the point. I'll try to remember this for next time, thank you.

Still could be improved a lot. I was thinking of writing up a "requirements doc" at some point for what exactly I think would be useful for such things. I'm not sure I'd be so happy with a Wiki, unless it was curated by trusted people. I wouldn't want (for example) malicious people editing a serious report to say it's no big deal just to buy themselves more time to exfiltrate more data.

I'd like to know this too.

The NIST page links to this site, which suggests no exploit is known of as yet:

https://www.securityfocus.com/bid/107063/exploit

NIST:

> Attack Vector (AV): Network

> Attack Complexity (AC): Low

SecurityFocus:

> Remote: No

> Local: Yes

¯\_(ツ)_/¯

Bogus NIST.

It's local. Of course that just means you have to chain it with a browser vulnerability to make it remote.

Reply on news.ycombinator.com