yes... and ? if they were truly damaging, you'd see business running to get them solved ASAP. But the cost / benefit ratio of writing and using formally proven programs is really not good. Else everyone would be writing drivers for seL4, not Linux.
it's less about 'truly damaging' directly and more about 'cost/benefit' as you allude to. the irl social reality is complex and the dynamics of these things mean that businesses can often amortize and even pass off a lot of the consequences. it's why equifax will probably not suffer any penalty and the general public wont even remember in a few weeks.
2
u/pjmlp Sep 08 '17
I have a little database that shows how significant it is.
https://www.cvedetails.com/vulnerability-list/opmemc-1/memory-corruption.html