- Twitter user posts alleged zero-day exploit for 7-Zip software
- However 7-Zip creator quickly debunks flaw
- Igor Pavlov says AI hallucination is to blame, and flaw isn’t legitimate
As a New Years Day gift, a Twitter user had posted details of a zero-day exploit in popular file compression software 7-Zip – but its creator, Igor Pavlov, swiftly debunked it as an AI hoax.
“The common conclusion is that this fake exploit code from Twitter was generated by LLM (AI),” he began in comments on software repository Sourceforge.net (via Tom’s Hardware).
Pavlov went on to suggest that the exploit code is, essentially, the product of an LLM hallucination – an AI making things up, which has become a common occurrence with AI’s rise in popularity.
7-Zip exploit code hallucination
“The comment in the “fake” code contains the statement: ‘This exploit targets a vulnerability in the LZMA decoder of the 7-Zip software. It uses a crafted .7z archive with a malformed LZMA stream to trigger a buffer overflow condition in the RC_NORM function.'”
“But there is no RC_NORM function in [the] LZMA decoder. Instead, 7-Zip contains RC_NORM macro in LZMA encoder and PPMD decoder. Thus, the LZMA decoding code does not call RC_NORM. And the statement about RC_NORM in the exploit comment is not true.”
We have no reason not to believe that what Pavlov is saying is true: 7-Zip is open source, for starters, so anyone can verify his claims.
And while we’re not going to name the Twitter user responsible for spreading the rumour, or link to the tweet, we would say that it sounds like a craven attempt at attention-grabbing on the internet – inconceivable, we know – given that the user claims to be running a week-long reveal of software 0-days as a “thanks to all new followers.”
It seems like the stormiest teacup you could imagine, but maybe you’ll hear from us again in a week’s time.
