📰 INDUSTRY NEWS

⏳ Linux Kernel Bugs Hide for 2+ Years Before Discovery

January 7, Pebblebed researchers analyzed 125,183 bugs from 20 years of Linux kernel history.

Average bug lifetime: 2.1 years before discovery.

But some subsystems are far worse:
→ CAN bus drivers: 4.2 years
→ SCTP networking: 4.0 years
→ Longest-lived: 20.7 years (buffer overflow in ethtool)

13.5% of bugs hide for 5+ years. These are the dangerous ones.

Why so long?
Only 28% of bugs have proper Fixes: tags. Niche protocols get less testing. Ancient bugs from 2010 take 10 years to find.

Good news: Bugs from 2024 are found in 5 months vs 10 years in 2010.

Bad news:

Your production kernel RIGHT NOW has bugs that:
→ Won't be found for 2-5 years
→ Are already exploited by ransomware (but nobody knows yet)
→ Will get a patch 1 month after public disclosure

You can't patch bugs you don't know exist.
But you can monitor when they're exploited.

Stay tuned! 🤓

#Linux #Security #Kernel #WebHostMost #CyberSecurity