SUDO Show 76, “ABCs of CVEs,” breaks down how modern Linux vulnerabilities go from scary headlines to real-world fixes. Bill, Neal, and Brandon start with conferences and Neal’s new Framework 13 Pro running Fedora, then dive into AI‑assisted security research and what tools like Claude and others are actually doing in the CVE pipeline. Neal walks through recent high‑profile issues like Pack2TheRoot in PackageKit, the copy.fail kernel optimization bug, and the Dirty Frag vulnerability, explaining how disclosure, embargoes, and coordination really work from a distro maintainer’s perspective. Brandon then focuses on CVE patching best practices, testing and release strategies, tools like Foreman and Uyuni for managing updates, and how to interpret CVSS scores and risk without panicking, before the crew wraps with advice for new grads who want to get into security without setting their hair—or their clusters—on fire.
Show Links:
- Foreman – https://theforeman.org/
- Uyuni – https://www.uyuni-project.org/
- Pack2TheRoot – Linux local privilege escalation write‑up
- copy.fail – kernel copy‑on‑write vulnerability
- Dirty Frag – universal Linux LPE PoC
Connect with the Hosts:
Neal - @[email protected] on Mastodon
Noel - https://github.com/noelmiller
