Something like this is rowhammer. Can it be exploited in a lab setting vs practically in the wild? Is fail2ban + WAF sufficient? How much network traffic is needed to remotely trigger the exploit in the field? How much inside knowledge of the system itself needs to be known?
These go from extreme edge cases to viable approaches over time, so it needs to be patched. I think the really messed up thing is the lack of communication from the Ubuntu team. If they have a rationale either way, that's fine. They may disagree on the severity, identified a problem in the fix, etc, but the lack of transparency is causing a loss of confidence in the team's abilities.
These go from extreme edge cases to viable approaches over time, so it needs to be patched. I think the really messed up thing is the lack of communication from the Ubuntu team. If they have a rationale either way, that's fine. They may disagree on the severity, identified a problem in the fix, etc, but the lack of transparency is causing a loss of confidence in the team's abilities.