16:14 <vagrantc> hey folks ... does this CVE against u-boot have any real merit? https://www.cve.org/CVERecord?id=CVE-2025-45512 ... it is firstly against an ancient version, and all the "exploits" require access to the u-boot console ... i mean, locking down the u-boot console might be a good thing to be able to do... but is it really an exploit?

16:14 <vagrantc> am i missing something?

16:15 <vagrantc> at a quick glance, it does not look like it actually bypasses any security measures ... just uses measures that have no lockdown mechanisms

16:15 <vagrantc> (for extra fun, it mentions some raspberry pi specific commands, even though the version it is talking about is from 7 years before the raspberry pi even existed)

16:16 <vagrantc> let alone had support in u-boot

16:16 <vagrantc> good ol' u-boot v1.1.3

16:16 <vagrantc> so i guess, in short, is there anything to actually be done about this one?

16:22 <marex> vagrantc: reading now

16:24 <marex> vagrantc: ugh, it sounds so ominous ... but all it does is it uses u-boot console ... indeed

16:25 <marex> vagrantc: this is really up to the device vendor to lock the device down, including disabling console access and such

16:44 <Tartarus> I've already complained to MITRE about that one, it's against a 20 year old (almost literally, Aug 14 2005, iirc) version of U-Boot

17:44 <vagrantc> marex, Tartarus: thanks for confirmation :)

18:32 <m4t> hmm is this smells of the ai slop that curl has been seeing from their bug bounty program: https://github.com/AzhariRamadhan/CVE-2025-45512/blob/main/exp.py#L139-L153

18:32 <m4t> -is

18:33 <m4t> https://daniel.haxx.se/blog/2024/01/02/the-i-in-llm-stands-for-intelligence/

18:45 <vagrantc> yeah, it did make me wonder a bit...

20:09 <marex> probably not AI, but it seems little effort went into understanding the project concepts or even into reading the README

20:38 <vagrantc> they do admit that they are testing a very old version, strangely enough

20:41 <marex> even the latest version would have the same "problem"

20:43 <vagrantc> indeed

21:28 <m4t> that python script is definitely ai written