# How I used o3 to find CVE-2025-37899, a remote zeroday vulnerability in the Linux kernel’s SMB implementation – Sean Heelan's Blog

<https://sean.heelan.io/2025/05/22/how-i-used-o3-to-find-cve-2025-37899-a-remote-zeroday-vulnerability-in-the-linux-kernels-smb-implementation/>

- Host: [sean.heelan.io](https://links.thingelstad.xyz/hosts/sean.heelan.io/)
- Saved: May 29, 2025 (2025-05-30T02:42:28Z)
- Record: https://links.thingelstad.xyz/links/d947ec1f60ee/
- JSON: https://links.thingelstad.xyz/links/d947ec1f60ee.json

## What Jamie wrote

One of the amazing use cases for LLMs and code is to find security vulnerabilities. Here Heelan uses it to see how well it can find very difficult Linux kernel bugs. I love how he uses multiple iterations and does a sort of Monte Carlo run. And wild that it finds it in some, but very few iterations. 

> o3 finds the kerberos authentication vulnerability in the benchmark in 8 of the 100 runs. In another 66 of the runs o3 concludes there is no bug present in the code (false negatives), and the remaining 28 reports are false positives. For comparison, Claude Sonnet 3.7 finds it 3 out of 100 runs and Claude Sonnet 3.5 does not find it in 100 runs._ _So on this benchmark at least we have a 2x-3x improvement in o3 over Claude Sonnet 3.7.

And in the resolution? His initial remediation wasn't sufficient and o3 helped identify that in a small subset of runs.

> Having realised this, I went again through o3's results from searching for the kerberos authentication vulnerability and noticed that in some of its reports it had made the same error as me, in others it had not, and it had realised that setting `sess->user = NULL`was insufficient to fix the issue due to the possibilities offered by session binding. That is quite cool as it means that had I used o3 to find and fix the original vulnerability I would have, in theory, done a better job than without it. I say 'in theory' because right now the false positive to true positive ratio is probably too high to definitely say I would have gone through each report from o3 with the diligence required to spot its solution. Still, that ratio is only going to get better.

This shows there is clear value here and honestly I think if you showed the original code to 100 engineers I would be surprised if even 8 of them found the issue.

## Facts

- Kind: [Page](https://links.thingelstad.xyz/kinds/page/)

## Appears in

- [WT321: Weekly Thing 321 / Saluting, Tetris, Sky](https://weekly.thingelstad.com/archive/321/), Notable

## Saved the same week

- [KrebsOnSecurity Hit With Near-Record 6.3 Tbps DDoS – Krebs on Security](https://links.thingelstad.xyz/links/35df97f56962/) (krebsonsecurity.com, May 29, 2025)
- [Just a QR Code](https://links.thingelstad.xyz/links/ceff24e7971c/) (justaqrcode.com, May 29, 2025)
- [The Way of Code | Rick Rubin](https://links.thingelstad.xyz/links/ead441480fea/) (thewayofcode.com, May 29, 2025)
- [How this year’s Pulitzer awardees used AI in their reporting | Nieman Journalism Lab](https://links.thingelstad.xyz/links/b0431ed97088/) (niemanlab.org, May 29, 2025)
- [2025 Milky Way Photographer of the Year - Capture the Atlas](https://links.thingelstad.xyz/links/7cd3659b75e1/) (capturetheatlas.com, May 29, 2025)

## Elsewhere

- Wayback Machine: https://web.archive.org/web/*/https://sean.heelan.io/2025/05/22/how-i-used-o3-to-find-cve-2025-37899-a-remote-zeroday-vulnerability-in-the-linux-kernels-smb-implementation/