BEGIN:VCALENDAR
VERSION:2.0
PRODID:jquery.icalendar
BEGIN:VEVENT
ORGANIZER:MAILTO:nur@eventhandler.co.il
TITLE:The Anatomy of a Patch: Backporting CVEs Without Breaking Things
DTSTART:20251211T141000Z
DTEND:20251211T142000Z
SUMMARY:The Anatomy of a Patch: Backporting CVEs Without Breaking Things
DESCRIPTION:When a new CVE drops, applying the fix isn't as simple as merging upstream changes––they hit live systems with layers of legacy, dependencies & constraints.Welcome to the shadowy underbelly of backports, a delicate operation where the goal is to surgically apply a fix, without disrupting the stability of older releases, prod systems or their intricate web of dependencies.This talk dissects CVE-2024-37370 in MIT Kerberos - a vuln that can be found in all of the major Linux variants and underpins cloud-native applications broadly, including many CNCF projects.We'll explore what constitutes a CVE-worthy vulnerability, what the vulnerable code actually looks like, and will reverse engineer how it's fixed. Then we'll walk you through step by step how to reverse-engineer a backport: unpacking the challenges of retrofitting fixes into older codebases, rewriting patches to accommodate shifting APIs, and avoiding side effects that ripple across documentation, test suites, & configs.
LOCATION:Main Stage
END:VEVENT
END:VCALENDAR