Unpatched Linux kernel flaws posted to the public LKML
Original title: Several Linux kernel vulnerabilities accidentally posted to public mailing list
Trend Micro ZDI reports include two CVSS 9.0 remote code execution issues; mainline fixes are not out, though some patches are in testing.
Trend Micro’s Zero Day Initiative sent several new Linux kernel vulnerability reports to the public Linux kernel mailing list instead of the private security list. Greg Kroah-Hartman asked about each public submission. The issues are not patched on mainline. Scores reach CVSS 9.0, including an SMB Direct integer underflow and a KSMBD race, both described as remote code execution. Other reports cover local privilege escalation and information disclosure, with some fixes already in testing or -next.
Unconfirmed: The public posting is described as seemingly accidental, and exploitation is not mentioned.
- ZDI-CAN-33549 is SMB Direct remote code execution via integer underflow, CVSS 9.0.
- A patch for that issue sits in a branch intended for Linux v7.5.
- ZDI-CAN-33774 is a KSMBD race condition also scored CVSS 9.0.
- ZDI-CAN-33367, ZDI-CAN-34068, and ZDI-CAN-32005 are local privilege escalation reports.
- ZDI-CAN-34076 is an NVMET uninitialized-resource information disclosure.
Impact: Remote code execution or local privilege escalation on Linux
| Product | Affected |
|---|---|
| Linux kernel | — |
- Vendors
- LinuxTrend Micro
- Products
- Linux kernel
- Organizations
- Zero Day InitiativeLinux kernel mailing list
From the original article
1 min read at phoronix.comSeemingly as an accident, overnight several new Linux kernel vulnerability reports were posted to the public Linux kernel mailing list rather than the private security mailing list. The vulnerabilities have yet to be patched on mainline but at least in some cases there are patches undergoing testing or queued in "-next" branches. The CVSS scores are as high as 9.
By mrkn1 · phoronix.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.