TECHNOLOGY
Several Linux kernel vulnerability reports mistakenly posted to public mailing list
Trend Micro's Zero Day Initiative appears to have sent several unpatched Linux kernel vulnerability reports to the public kernel mailing list instead of the private security list. Some have CVSS scores as high as 9.0, and patches are in testing or queued for a few of them.
Image: IntraGoals Media
Several reports about unpatched Linux kernel security flaws were posted overnight to the public Linux kernel mailing list instead of the private security list. It looks like a mistake. The flaws have not yet been fixed in the mainline kernel, though some already have patches in testing or queued in "-next" branches, which are staging areas for code headed to mainline.
The reports came from Trend Micro's Zero Day Initiative, which sent them to the public Linux kernel mailing list (LKML). Security reports normally go to a private list so fixes can be prepared before details become public. Greg Kroah-Hartman, a senior Linux kernel maintainer, replied to each report asking about why it had been sent to the public list. The source describes him as Linux's second-in-command.
The highest CVSS scores among the reports are 9.0. CVSS is a standard 0-to-10 scale for rating how severe a vulnerability is.
ZDI-CAN-33549 is an SMB Direct remote code execution flaw caused by an integer underflow, which is a math error where a number drops below what its type can hold. It is rated 9.0. A patch already exists in a Git branch of code meant for Linux v7.5. The source presumes it will now be rushed to mainline.
ZDI-CAN-33774 is a race condition in KSMBD that can lead to remote code execution. It is also rated 9.0.
ZDI-CAN-33367 affects skb_zerocopy in the kernel's networking code and can lead to local privilege escalation. Kernel developers had received a report on the same issue from another source last week. A patch is expected to be posted soon.
ZDI-CAN-34068 is an out-of-bounds write in VMWGFX, the VMware graphics driver, and can also lead to local privilege escalation.
ZDI-CAN-34076 is an uninitialized resource in the NVMET code that can lead to information disclosure.
A sixth report, ZDI-CAN-32005, was posted to the list a day earlier. It describes a stack buffer overflow in a search-domain TCP query, which can lead to local privilege escalation.
The source adds that bug and security reports keep coming in what it calls an AI-fueled world.