We derestricted a number of vulnerabilities found by Big Sleep in JavaScriptCore today: https://t.co/mKSWXXWmXG
All of them were fixed in the iOS 26.1 (and equivalent) update last month. Definitely some cool bugs in there!
Really excited to finally announce CodeMender!
As part of this we've already submitted and upstreamed several patches to OSS projects via OSS-Fuzz.
Check out our post at: https://t.co/qgnroQyIzN
There will be more technical details and exciting announcements to come!
Software vulnerabilities can be notoriously time-consuming for developers to find and fix.
Today, we’re sharing details about CodeMender: our new AI agent that uses Gemini Deep Think to automatically patch critical software vulnerabilities. 🧵
OSV-Scanner has just released the first beta for V2, a major update that includes significant new features, including layer-aware container scanning, remediation for pom.xml, new HTML output and more.
https://t.co/kkPK2KHBTk
Please try it out and give us feedback!
Today, we announced the official release of OSV-SCALIBR, Google's software composition analysis library. If you are working in vuln management / security scanning, SCALIBR is for you! SCALIBR is powering most of Google's vuln scanning. Please RT
https://t.co/Xk95hlSQwd
Happy new year! OSV had a lot of great progress in 2024, from new ecosystem adoption, API improvements, and scanner feature development! We just published a blog about these and our 2025 plans here: https://t.co/7vRkoPHZfO !
@jduck@clintgibler@metzmanj This is a very fair point! This is exactly why we haven't turned this on by default for all OSS-Fuzz users. One of our next priorities is to automate as much of the triage to determine if it's a legit vuln / attack surface or not (e.g. using an LLM and/or past reported vulns).
The OSS-Fuzz team at @Google is using AI-powered fuzzing to find vulns in open-source software and recently reported 26 new vulns to open-source project maintainers, including one in the OpenSSL library which is critical to most internet infrastructure. https://t.co/2UuBC0U4Xo
On the heels of @Google’s ‘Big Sleep’ AI discovery of a real-world vulnerability, our OSS-Fuzz team identified and reported 26 vulnerabilities to open-source project maintainers by using AI-generated and enhanced fuzz targets. Read more here: https://t.co/6SfPt38ZmE
New blog post about OSS-Fuzz AI-powered fuzzing is live!
We talk about what went into making LLMs work well enough for this use case to find 26 new vulnerabilities (including a CVE in OpenSSL), as well as what else we have planned to make this better.
https://t.co/ewCUmtRs6P
Red Hat joins OSV! https://t.co/M6yDyTwMpE
Combined with Ubuntu, Chainguard, and SUSE adopting OSV this year, https://t.co/JhJ5uLdAjV has really started to become a comprehensive vulnerability source for not only language packages, but also Linux distros!
CVE-2024-9143 (https://t.co/ApXML9Eiuv) was disclosed recently, which was found by OSS-Fuzz-Gen! This is a pretty proud example of our team showing the promise of leveraging LLMs enable more fuzzing coverage.
OSV support announced in the latest Ubuntu 24.10 release!
This year has seen OSV adoption from many Linux distributions, and the https://t.co/JhJ5uLd2un database is starting to become a really comprehensive source of accurate vuln info across major open source ecosystems!
Today, we proudly unveil Ubuntu 24.10, codenamed "Oracular Oriole" 🔮
Packed with GNOME 47, the Linux 6.11 kernel, permissions prompting, an enhanced command line, OpenVEX and OSV support, and a special #Ubuntu20Years anniversary gift - there’s plenty for you to explore 🚀
Read more: https://t.co/bOfOabbuM0
#Ubuntu #Linux #OracularOriole
Today, we proudly unveil Ubuntu 24.10, codenamed "Oracular Oriole" 🔮
Packed with GNOME 47, the Linux 6.11 kernel, permissions prompting, an enhanced command line, OpenVEX and OSV support, and a special #Ubuntu20Years anniversary gift - there’s plenty for you to explore 🚀
Read more: https://t.co/bOfOabbuM0
#Ubuntu #Linux #OracularOriole
@microsvuln @dobinrutis I expect that we'll need to do a combination of:
- Implementing these easier automated checks to prune out obvious false positives from incorrect/bad harnesses.
- Have some kind of feedback mechanism from project maintainers (e.g. an annotation on public APIs) to help us out
One week later the bug count is now at 25 bugs total (https://t.co/sjDnDMze7e)
There's still many improvements to be made to improve success rate of generated targets, but we now have the problem of too many crashes to triage. Automating this will a focus of our future research.
This week we've added another 8 trophies to OSS-Fuzz-Gen (for a total of 14)! These are vulnerabilities found by LLM-generated harnesses. The interesting bit here is many of these are in well-fuzzed projects with thousands of hours of fuzzing already.
https://t.co/sjDnDMyGhG
@microsvuln @dobinrutis Yep, there's a lot of low hanging fruit things we can do to determine these automatically (or use an LLM).
However, there are also cases when, even as a human, it's hard to tell if something is a legitimate bug or not because of unclear API preconditions and threat models.