1573 stories
·
0 followers

You can use your old laptop to make a smart home hub

1 Share
An old netbook can automate the devices that otherwise aren't interested in talking to one another.

Read the whole story
Share this story
Delete

Debugging walkthrough: Access violation on nonsense instruction, episode 3

1 Share

A customer reported that their employees were randomly getting “memory write errors”.

This was their way of interpreting the error message

The instruction at “XX” referenced memory at “YY”. The memory could not be “written”.

Okay, so what we have here is an access violation.

The strange thing was that this access violation was happening across multiple unrelated programs, rather than all occurring in a single program or family of programs. So there is some sort of broader problem here, rather than just a single buggy program.

Opening one of the crash dumps shows this:

eax=0013d354 ebx=0049a000 ecx=009e9a9f edx=03111160 esi=009e9aa0 edi=009e9aa0
eip=009e9aa7 esp=003cfda4 ebp=003cfdb0 iopl=0         nv up ei pl nz ac pe cy
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010217
WerFault!wmainCRTStartup+0x7:
009e9aa7 0000            add     byte ptr [eax],al          ds:002b:0013d354=??
0:000>

That add byte ptr [eax], al should immediately tell you that we are not executing valid code: It is the instruction that you get if you try to execute zeroes. You can see the zeroes in the second column.

All of the crash dumps look like this, just with different process names.

Let’s disassemble from the start of the function to see how we got here.

0:000> u .-7
WerFault!wmainCRTStartup:
009e9aa0 90              nop
009e9aa1 49              dec     ecx
009e9aa2 ba6011f102      mov     edx,2F11160h
009e9aa7 0000            add     byte ptr [eax],al ← died here
009e9aa9 0000            add     byte ptr [eax],al
009e9aab 41              inc     ecx
009e9aac ffe2            jmp     edx
009e9aae cc              int     3

This doesn’t look like the proper start of a function.

I mean, one clue is that it starts with a single-byte nop, rather than a mov edi, edi, as is customary for x86-32 code.¹

And then of course there is the chunk of four 00 bytes in the middle of the instruction stream.

What I thought was interesting is that if you take out those four 00 bytes, then the dec ecx and inc ecx cancel out, and what’s left looks like a detour: It loads an absolute address into edx and then jumps to it.

This looks to me like a failed attempt to detour the function. The next step is to try to figure out what they were trying to do.

Well, it looks like it’s trying to detour to a function at 0x02f11160, so let’s see what the debugger can tell us about that.

0:000> !address 0x2f11160

Usage:              <unknown>
Base address:       02f11000
End address:        02f12000
Region Size:        00001000 (4.000 kB)
State:              00001000 MEM_COMMIT
Protect:            00000020 PAGE_EXECUTE_READ
Type:               00020000 MEM_PRIVATE
Allocation Base:    02f10000
Allocation Protect: 00000004 PAGE_READWRITE

So this is a mystery 4KB allocation of executable memory.

Maybe there are some interesting strings in that memory block.

0:000> !strings 02f11000 02f12000
02f11080 --------
02f11148 ----------------
02f11472 C:\Program Files\Common Files\Contoso\injcore.dll
02f11545 IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIII

Okay, well, that path to a DLL kind of catches them red-handed. I bet the “inj” stands for “injection”. But what were they trying to do?

I figured, “Hm, the extra four zero bytes come right after the constant they were trying to load, so if I change the mov edx to a mov rdx, it would be the upper half of a 64-bit constant, and then this would look okay again.

Now, this is a 32-bit process (evidenced by the 32-bit instruction pointer), so there is no mov rdx instruction. That instruction requires a 64-bit process.

But wait, what if they got confused and thought it was a 64-bit process?

Let’s disassemble these bytes as if they had been injected into a 64-bit process.

The way I do this is to load up a sacrificial 64-bit debug session and just patch into it the bytes that I want to study. For poetic irony, I will load the 64-bit WerFault.exe into the debugger as a dump file.

C:\> windbgx -z C:\Windows\System32\WerFault.exe

Executable search path is: 
ModLoad: 00000001`40000000 00000001`400a1000   C:\Windows\System32\WerFault.exe
WerFault!wmainCRTStartup:
00000001`40002480 sub     rsp,28h
0:000> eb . 90 49 ba 60 11 f1 02 00 00 00 00 41 ff e2 cc
0:000> u .
WerFault!wmainCRTStartup
00000001`40002480 nop
00000001`40002481 mov     r10,2F11160h
00000001`4000248b jmp     r10
00000001`4000248e int     3

Okay, now it makes much more sense. This is a 64-bit detour that loads an absolute jump target into a 64-bit register (r10) and then jumps to it.

They injected 64-bit code into a 32-bit process!

This also explains why the crashes are sporadic: The customer’s employees run 64-bit processes most of the time, but on occasion, something will run a 32-bit process, and those are the ones that are crashing.

Upon further discussion with the customer, we learned that Contoso is an anti-malware program that they use. We advised them to disable it temporarily to confirm that it was the source of the problem, but they didn’t want to disable their anti-malware software.

Okay, so we advised them to check with the vendor to see if an update is available. They were resistant to changing their anti-malware software without first putting it through their internal validation. They considered this a Windows problem, and they demanded a Windows solution.

We are still working to convince the customer that they need to re-evaluate their anti-malware software.²

¹ Even if this were a 64-bit process, Windows components don’t begin functions with a single-byte nop or any other single-byte instruction. It would use a two-byte nop if it uses one at all.

² This is a downside of communicating with the customer through a customer liaison: My colleague explained that relaying this level of detail through a customer liaison who is not sufficiently technical to be familar with debugging puts us at a disadvantage because the liaison can’t stand up to the customer pushback. This is a case where we may have to let the engineers talk directly to the customer.

The post Debugging walkthrough: Access violation on nonsense instruction, episode 3 appeared first on The Old New Thing.

Read the whole story
Share this story
Delete

Can Trump ever be wrong? His pick to lead FDA refused to say.

1 Share

Heidi Overton, President Trump's nominee to lead the Food and Drug Administration, went before the Senate health committee Thursday, facing questions about her stances on vaccines, flavored vapes, birth control, and abortion, among other issues. She spent nearly two hours stonewalling senators, even on softball questions.

Overton, a physician with a doctoral degree in clinical investigation, is currently the deputy assistant to the president for domestic policy. She previously worked at a conservative think tank and has taken a clear stance opposing abortion, raising obvious questions about her objectivity. The FDA is currently reviewing the safety of the abortion pill, mifepristone, despite extensive data showing it is extremely safe.

Overton also notably stood behind President Trump at a press conference in August during which Trump falsely called the measles, mumps, and rubella (MMR) vaccine "quite lethal." He further claimed that vaccine doses for infants are "like the size of a soda bottle," and called for the MMR vaccine to be split into three separate immunizations, despite no evidence of benefit from such a split and no such individual immunizations being available in the US.

Vaccine contradictions

In the hearing, Overton directly contradicted Trump on several occasions, saying at various times that "the MMR vaccine is not lethal" and that "the MMR vaccine is safe and effective."

Still, when Sen. Maggie Hassan (D-NH), asked "Do you think it's possible for the president to ever be wrong about something?" Overton dodged. Instead of answering the question, she began spouting a non-answer that started with: "I've had the privilege of working for the president for over a year and a half and have had robust discussions with him."

Hassan cut her off, pressing: "Is it possible for him to be wrong?" But again, Overton was evasive.

Hassan asked her if she thought the MMR vaccine might be lethal. Again, Overton said it was safe and effective. "So," Hassan asked,"was the president wrong when he suggested that the combined measles, mumps, and rubella vaccine may be lethal?"

"Senator, the president asks questions and wants the best outcomes for the American people right now."

Hassan kept pressing, switching to Trump's false claim that Tylenol taken during pregnancy is linked to autism in children. "Was he wrong when he said that? Yes or no?" Again, Overton didn't answer, only saying "There is no current evidence of a causal link between Tylenol and autism."

"I wish it wasn't so difficult for members of the administration to just plainly say that the president's wrong," Hassan said. "And it's really concerning to me that you are equivocating on it here."

Bad options

Sen. Lisa Blunt-Rochester (D-Del.) also asked about the vaccine claims Trump made in August, noting that reports suggested it was Overton herself who suggested to Trump that the combination vaccine could be split into multiple shots. Even if there was reason to think splitting the vaccine would improve safety and/or efficacy, it would take huge investments and years of trials to get the individual vaccines approved in the US.

"So obviously," Blunt-Rochester asked, "you think these were good options, correct?"

Overton replied that, in her current role, her job is to give Trump options.

"You wouldn't have provided bad options, right?"

But Overton again wouldn't answer Blunt-Rochester's question. "This is just a simple question," Blunt-Rochester interjected. "This, I thought, was the easy question." Blunt-Rochester went on to ask Overton if she reviewed data about splitting the MMR vaccine or if current doses were the size of a soda bottle, but again she dodged the questions.

Flavored vapes

The FDA has been without a commissioner since May, when Marty Makary resigned from the role after resisting Trump's pressure to approve flavored vapes. The FDA issued a policy allowing their sale in early May, despite bipartisan opposition to the products, which are largely seen at being marketed to youth.

Sen. Chris Murphy (D-Conn.) laid out a timeline of how it happened, saying:

On April 30th, it's a Thursday afternoon, Reynolds, one of the biggest tobacco companies in the country, makes an $8 million donation to the president. Two days later on Saturday, because of that donation, they have lunch with the president and they tell him that they want a change in FDA rules, especially regarding flavored vapes. The president calls the FDA commissioner, he calls the secretary of [the health department], and three days later on Tuesday, new guidance is issued that paves the way to the sale of flavored vapes.

Murphy asked Overton if she saw a connection between the donation and the policy change, and if that's how she thinks the FDA should work. "I reject the framing of that question," Overton replied, adding that Trump is "committed to the best possible outcomes for American."

Sen. Tim Kaine (D-Va) pushed Overton on upcoming plans that the Trump administration has to further ease regulation of tobacco products, including fruity vapes. Kaine asked what Overton, a key domestic policy advisor, knew about the upcoming changes. But Overton would only say that she was "not involved in those discussions."

"Dr. Overton, now come on, don't play games with me," Kaine said. "I didn't ask whether you were involved in them. I asked, are you aware ... are you aware of discussions that is going on about whether the FDA will roll back tobacco safety regulations? And that's an easy [question]. You're either aware of them or you're not."

After again declining to answer the question, Kaine gave up, saying "Let the record reflect that the witness refused to answer the question. I yield."

"Pretty good job"

On the topic of birth control and abortion, Overton was equally evasive, refusing to say whether she thinks IUDs (intrauterine devices) are a form of abortion or whether women are polluting the water supply by taking birth control pills—both things anti-abortion groups claim.

Even for friendly questions, Overton refused to answer things directly. Sen. Ashley Moody (R-Fla.) asked about illegal, imported vapes, something Overton mentioned wanting to crack down on in her opening statement. Moody asked a softball question, simply getting Overton to confirm the FDA's current rules for vaping products, which allow products to be sold while applications for FDA approvals are pending.

"If someone files an application, they can sell, right?" Moody asked multiple times.

But Overton didn't answer the question and Moody became frustrated, exclaiming at one point: "I'm just trying to find out what the law is!"

Halfway through the hearing, Murphy summed it up succinctly, telling Overton: "You've done a pretty good job of avoiding answering questions."

Read full article

Comments



Read the whole story
Share this story
Delete

No, really, you need to pass all unhandled messages to DefWindowProc, part 2

1 Share

A customer reported a memory leak in Windows that occurred when they called Register­Drag­Drop followed by Revoke­Drag­Drop. They included a time travel trace of a sample program that demonstrated the problem. (Though for some reason, they didn’t include the program itself; just the time travel trace.)

Now, it is strange that there would be a memory leak if you call Register­Drag­Drop followed by Revoke­Drag­Drop, seeing as this pattern is used heavily by thousands of applications, including many parts of Windows itself, so if there were a memory leak inherent in the pattern, you’d think it’d have been reported by now.

I suspected that there was something special about their sample program.

Some time ago, I noted that No, really, you need to pass all unhandled messages to DefWindowProc. And that was the source of the problem.

Debugging through the time travel trace showed that yes, they did call Register­Drag­Drop, and then they did call Revoke­Drag­Drop. But there’s more going on. When the window receives a WM_DESTROY message, it cleans up all its state. And for any messages that arrive after WM_DESTROY, the window procedure goes looking for its special state and doesn’t see it, so it gives up and just returns 0 without passing the message to Def­Window­Proc.

Oops.

If the window procedure can’t figure out what to do, it should pass all messages to Def­Window­Proc. In this case, it’s important because some of those messages are cleanup messages, and one of the things those cleanup messages do is free the last few fragments of memory still hanging around.

Bonus chatter: But if I register a drop target, and then revoke it, shouldn’t the revoke free all the memory that was allocated by the register call?

There’s no requirement that registering something and then unregistering it will immediately free all the memory associated with the registration. The system is allowed to cache stuff that it thinks will be needed again.

In this case, what happened is that the Register­Drag­Drop function uses an infrastructure that is shared by many components. That infrastructure is created and attached to the window the first time anybody needs it, and it is cleaned up when the window is destroyed. The memory isn’t leaked. It’s just cached on the window, waiting to be used by another operation. And the cache is destroyed when the window is destroyed.

But it assumes that you give Def­Window­Proc a chance to do that cleanup.

The post No, really, you need to pass all unhandled messages to DefWindowProc, part 2 appeared first on The Old New Thing.

Read the whole story
Share this story
Delete

Trump’s sneaky plan to gut Endangered Species Act draws from 1995 Scalia dissent

1 Share

Last week, The New York Times reported that an internal memo had been quietly distributed across US Fish and Wildlife Service (FWS) field offices, directing staff to radically reinterpret the Endangered Species Act (ESA) in a move that blindsided conservationists.

Staffers were essentially asked to start looking the other way when private interests cause preventable deaths of vulnerable animals. Instead of prohibiting habitat modifications that injure animals or cause accidental deaths, the ESA will now only prohibit actions “specifically intending to target an animal,” FWS Director Brian Nesvik instructed staff in the September 14 memo.

“A vessel that inadvertently strikes a whale has not taken it because the vessel’s course was not set against the whale,” Nesvik’s memo said. “Felling a tree is not a take of the bats roosting in it unless the tree is felled for the purpose of killing or capturing them.”

FWS did respond to Ars’ request to clarify if this rule change has already taken effect, but environmental advocates are alarmed because it follows a rule change earlier this year that removed the destruction of habitat from the ESA’s definition of harm. At that point, the administration insisted the goal was to prevent extra costs to landowners when animals weren’t in danger. But the more recent rule change goes much further, allowing the animals to be killed as long as that’s not the landowners’ motivation for taking an action.

Ben Levitan, a senior attorney for legal conservation nonprofit Earthjustice, told the nonprofit news organization Stateline that advocates felt they were falsely reassured when the definition of harm was changed and that the administration would not use that change to justify a policy of ignoring preventable deaths.

“This is an incredibly sneaky and disingenuous way of going about things,” Levitan said.

Such incidental takings are the most common way that endangered animals die, the NYT reported, so advocates fear the move largely guts the ESA. Previously, businesses had to conduct environmental reviews to identify critical habitat, then either take steps to preserve it or get permits to offset any accidental killing by donating to conservation funds elsewhere.

Stripping that protection could immediately threaten not just individual animals but entire populations, as Supreme Court justices acknowledged in 1995 when it was first ruled that the ESA prohibited harm by preventing the modification of critical habitats.

But Donald Trump believes that 1995 opinion was invalidated by a more recent Supreme Court decision to kill the “Chevron doctrine,” which justices found had previously given agencies too much authority to reinterpret ambiguous laws when Congress’ intent wasn’t clear. At least one judge weighing the 1995 case characterized the secretary’s reading as “a proper application” of the Chevron doctrine, the majority noted in their opinion.

According to the Times, Trump is so intent on flipping the ESA that the dissent in that 1995 ruling is now serving as the “blueprint” for how his FWS plans to enforce the law. So it’s worth revisiting that 1995 dissent as courts revive the decades-old debate in today's legal landscape.

Penned by the late Justice Antonin Scalia, the dissent takes jabs at threatened slugs for not having feelings while envisioning a world where the ESA has nothing to do with protecting endangered populations and the government can do little to prevent accidental deaths.

Protecting populations snubbed as "simplistic"

Back in the ’90s, some small landowners and logging companies and their families sued to block the secretary of the Interior from reading the ESA as prohibiting "significant habitat modification or degradation where it actually kills or injures wildlife."

Claiming that the secretary was exceeding his authority, they said they would be financially harmed if they were forced to avoid modifying habitats of a then-endangered species, the red-cockaded woodpecker, and a threatened species, the northern spotted owl. They asked the court to prohibit the secretary from preventing habitat modification—even when businesses or landowners knew that an activity would result in the extinction of a listed species by destroying its habitat.

Northern spotted owls. Credit: Kevin Schafer | The Image Bank
Red-cockaded woodpecker. Credit: Jared Lloyd | Moment

The majority rejected that logic, and they did so based not on an interpretation of the secretary’s authority under the law but on a textual reading of the law, Patrick Parenteau, an emeritus professor at the Vermont Law and Graduate School, told the Times.

But Scalia clearly sided with the landowners, as did Clarence Thomas and William Rehnquist. In his dissent, Scalia argued that the ESA was written narrowly to prohibit the intentional hunting and killing of vulnerable animals, not to broadly protect species at the population level. He seemed to find it particularly preposterous that the ESA would protect animals' breeding grounds.

Scalia argued that the majority imposed “unfairness to the point of financial ruin—not just upon the rich, but upon the simplest farmer who finds his land conscripted to national zoological use."

As he saw it, the majority was being overly “simplistic” in assuming that anything that furthers the mission of protecting endangered species should be covered by the ESA. He even took time in a footnote to mock Sandra Day O’Connor for writing in her concurring opinion that destroying breeding grounds could be considered an injury to animals.

Animals not capable of "painful sentiments"

Saying that she didn't find it as “easy” as Scalia to “dismiss the notion that significant impairment of breeding injures living creatures,” O’Connor argued that “to raze the last remaining ground on which the piping plover currently breeds, thereby making it impossible for any piping plovers to reproduce, would obviously injure the population (causing the species’ extinction in a generation).”

And it would injure individual animals, she suggested. “By completely preventing breeding,” unchecked developments on critical habitats “would also injure the individual living bird, in the same way that sterilizing the creature injures the individual living bird.” Further, animals could suffer in other ways from loss of breeding habitat, she wrote:

The regulation has clear application, for example, to significant habitat modification that kills or physically injures animals which, because they are in a vulnerable breeding state, do not or cannot flee or defend themselves, or to environmental pollutants that cause an animal to suffer physical complications during gestation. Breeding, feeding, and sheltering are what animals do.

In a footnote, Scalia said O’Connor’s ESA interpretation was “imaginative,” suggesting that if she was advocating against “psychic harms,” why not include “the psychic harm of not being able to frolic about?”

“Assuming, of course, that the animal in question, perhaps an endangered species of slug, is capable of such painful sentiments,” Scalia wrote.

Insisting that lines must be drawn, Scalia argued that an animal should not be considered injured under the ESA simply because its ability to breed had been impaired. And the Secretary back in 1995 had no authority to evaluate what was harmful habitat modification in such a “willy-nilly” way, he said.

Under the ESA, an animal is only injured when “a class of acts (not omissions)” is “done directly and intentionally (not indirectly and by accident)” to “particular animals (not populations of animals),” Scalia argued. The only way the US could protect a species was by paying landowners to acquire land, not by imposing costs on private landowners, Scalia argued.

In Scalia's view, Congress drafted the ESA to clearly distinguish "taking" an animal from disrupting its habitat. Lawmakers chose to prohibit the killing or injury of a threatened species or else require a permit to offset the imbalance from any incidental takings. That interpretation of the ESA is the one the Trump administration is moving toward.

“Only action directed at living animals constitutes a ‘take,’” Scalia wrote.

Legal experts defend the ESA

Not everyone expects that the death of the Chevron doctrine will allow Trump to gut the ESA. In 1995, the majority held that Congress clearly intended to include habitat modification in the ESA under the definition of “harm” and suggested that Scalia cherry-picked his dissent to cite only legislative history supporting his position. In the opinion drafted by late Justice John Paul Stevens, he wrote that not only does the “broad purpose of the ESA” support the secretary’s reading, but so does the fact that Congress requires permits for presumably otherwise illegal incidental takings.

Perhaps most notably, when drafting the ESA, lawmakers “stated that ‘the broadest possible terms’ were used to define restrictions on takings,” specifically to ensure that they included “harassment, whether intentional or not,” Stevens wrote.

“Under the dissent’s interpretation of the Act, a developer could drain a pond, knowing that the act would extinguish an endangered species of turtles, without even proposing a conservation plan or applying for a permit,” unless the developer was “motivated by a desire ‘to get at a turtle,’” Stevens wrote.

The Trump administration is already facing lawsuits, including one from a coalition of 21 attorneys general over changes to the ESA, so it’s unclear if the Scalia dissent’s lens on the ESA will ever be widely adopted by wildlife officials previously dedicated to protecting all vulnerable animals.

A spokesperson for the FWS defended the changes to Inside Climate News, saying that “these lawsuits seek to preserve a decades-old regulatory overreach that expanded the Endangered Species Act beyond the authority granted by Congress. The Department will vigorously defend its authority to implement the law according to its plain text.”

A spokesperson for the Interior Department told NYT that the ESA “continues to prohibit take of endangered wildlife, including actions that harass, pursue, hunt, shoot, wound, kill, trap, capture or collect listed wildlife, or attempts to do so.”

At least some environmental legal experts seem confident that this dispute over the ESA isn’t about who has the authority to interpret the statute, though. Rather, it’s about what the statute says, and in 1995, the court found that simply knowing that a protected species could be injured or killed when taking an action was enough to violate the ESA.

Andrew Mergen, a law professor at Harvard University who previously supervised ESA legislation for the Department of Justice, told the NYT that the FWS memo’s directive “is really an assault on the act like we’ve never seen before.”

“What the administration is proposing to do is take all of the force out of what we have all understood the act to mean: Don’t kill endangered species,” Mergen said. “What they seem to be saying in this document is 'it doesn’t matter if you killed an endangered species if you didn’t mean to.'”

Parenteau, the Vermont law professor, told the Times that he expects FWS will struggle to defend the policy.

“To say that the law is settled in favor of Scalia’s dissent?” Parenteau said. “Absolutely not.”

Read full article

Comments



Read the whole story
Share this story
Delete

RFK Jr.'s CDC isn’t letting states order COVID-19 shots for kids, blocking access

1 Share

As respiratory virus season nears and fall vaccination drives get underway, more than half of US children are facing uncertainty over access to this year's COVID-19 shot. The Centers for Disease Control and Prevention has unexpectedly delayed the distribution of the shots to a key federal program and some states.

Usually, the CDC would allow states to order the newly available seasonal COVID-19 vaccines through the federal Vaccine for Children (VFC) program, which provides vaccines at no cost to children who are uninsured, underinsured, Medicaid-eligible, or Indigenous people in the US. Approximately 52 percent of all US children are eligible for vaccines through the program.

Additionally, The Guardian reports that at least 11 states and one US territory are part of a universal vaccine purchase program, in which they buy all vaccines for children—regardless of their ability to pay or insurance status—through contracts otherwise for the VFC. The 11 states and one territory include: Alaska, Connecticut, Hawaii, Maine, Massachusetts, New Hampshire, New Mexico, Rhode Island, Vermont, Washington, Wyoming, and American Samoan.

"The delay in VFC means delays in these states' ability to get vaccine for all children," Demetre Daskalakis, former director of the CDC’s National Center for Immunization and Respiratory Diseases and chief medical officer at Callen-Lorde Community Health Center, told The Guardian.

Kennedy's track record

In a statement, the Department of Health and Human Services told Ars Technica that "CDC has not yet finalized procurement decisions for COVID-19 vaccines through the Vaccines for Children and Section 317 programs." The department—currently run by ardent anti-vaccine activist Robert F. Kennedy Jr.—declined to answer the question of why there was a delay in the decision. But the statement suggested that Trump officials were questioning whether children should get the vaccine.

"HHS and CDC are committed to ... ensuring that vaccines purchased through federally funded programs are appropriate for the populations those programs serve," the department said in the statement. It added that additional information about the decision will be released "soon."

The unexplained delay fits with Kennedy's well-established disdain for COVID-19 vaccines, which he has falsely called "the deadliest vaccine[s] ever made," and has actively tried to blame them for the deaths of children, despite no evidence to support the allegations.

In 2021, at the height of the pandemic, Kennedy petitioned the Food and Drug Administration to revoke authorization of COVID-19 vaccines and refrain from issuing any other approvals, also falsely claiming that the "risks of serious adverse events or deaths outweigh the benefits." Instead, Kennedy's petition urged the FDA to promote the use of the de-worming drug ivermectin and the anti-malaria drug hydroxychloroquine against COVID-19, which were found to be ineffective and potentially risky in large, high-quality clinical trials.

Last year, Kennedy unilaterally revoked recommendations for COVID-19 vaccines for children (as well as during pregnancy). Last fall, he also dragged his feet on signing off on CDC recommendations for the shot.

Current recommendations

After a federal judge reversed many changes Kennedy made to federal vaccine guidance, the current CDC vaccine schedule for children says that healthy children aged 6 months to 17 years can get the vaccine through "shared clinical decision-making" and children who are moderately or severely immunocompromised are recommended to get the shot.

The guidance differs from what leading medical organizations have recommended for this year. Earlier this month, 2026–27 respiratory virus immunization recommendations and the evidence base behind them were released in a collaborative effort by the American Medical Association, the Vaccine Integrity Project, the American Academy of Pediatrics (AAP), the American Academy of Family Physicians (AAFP), the American College of Obstetricians and Gynecologists (ACOG), and the Infectious Diseases Society of America (IDSA).

The medical groups recommend that children aged 2 to 18 get vaccinated if they are at higher risk or if they desire to be vaccinated. But, notably, they continue to strongly urge that all infants age 6 months to 23 months get vaccinated against COVID-19.

"The youngest children remain at high risk for severe disease," American Academy of Pediatrics wrote in a news release this month. The hospitalization rate of infants 6 to 11 months during the 2024-’25 season was higher than that of adults ages 50-64 years, the academy noted. And most young children hospitalized with COVID-19 are healthy and not at high risk; only about 42 percent of children ages 6 to 23 months hospitalized from October 2022 to April 2024 had an underlying condition.

Roberta DeBiasi, who led the AAP Committee on Infectious Diseases COVID-19 subgroup, said "If you look at it from the standpoint of how severe their disease can be, the number of hospitalizations and how many of those children you’d need to vaccinate to prevent that, it’s really on par with the older adults."

Read full article

Comments



Read the whole story
Share this story
Delete
Next Page of Stories