lopsidedBrain

I religiously apply patches to all my personal machines as soon as they become available. But I've recently been wondering about how much of a difference it makes today. I used to follow this space fairly closely 4-5 years ago, but I don't know what has changed since then.

Once a typical use-after-free vulnerability is disclosed publicly, for example, how quickly does it get weaponized? I remember reading some academic papers a while back, which claimed to be able to automatically generate exploits from a patch. I believe ROP compilers exist also that will take some logic and string it together with a given set of gadgets in a binary. What is the current state of all that tooling?

Bottomline: Are there stats (e.g. from honeypots) that tell us the likelihood of a typical laptop/mobile user being compromised based on a given security flaw, given the amount of time they run unpatched after disclosure?

I figured there must be experts here who have been keeping up with all of this better than I have. I'd love to hear from you all!