Several Linux Kernel Vulnerabilities Accidentally Posted To Public Kernel Mailing List

Trend Micro's Zero Day Initiative appears to have accidentally disclosed several unpatched Linux kernel vulnerabilities on the public LKML instead of the private security list, including two CVSS 9.0 flaws that could enable remote code execution through SMB Direct and KSMBD. "This seemingly was a mistake with Linux's second-in-command Greg Kroah-Hartman responding to each report asking about their submission to the public mailing list," adds Phoronix. The newly-disclosed vulnerabilities include: ZDI-CAN-33549 as a CVSS 9.0 scored vulnerability for SMB Direct remote code execution vulnerability due to integer underflow. For this one there is a patch in a Git branch of code intended for Linux v7.5 but now presumably will be expedited for getting to mainline.

ZDI-CAN-33774 as a KSMBD race condition that can lead to remote code execution. Another CVSS 9.0 rated vulnerability.

ZDI-CAN-33367 is a vulneravbility for skbuff skb_zerocopy in the network code that can lead to local privilege escalation. For this one Linux kernel developers received a security report from another source last week over the same issue and a patch is expected to be posted soon.

ZDI-CAN-34068 as a VMWGFX VMware graphics driver bug with an out-of-bounds write leading to local privilege escalation.

ZDI-CAN-34076 an uninitialized resource in the NVMET code leading to information disclosure.

ZDI-CAN-32005 was also posted to the mailing list a day prior for a search-domain TCP query stack buffer overflow leading to local privilege escalation.

So you are saying ...

[davidwr]

... that wetware has vulnerabilities too?

Or to put it another way: "Oops, I didn't mean to do that, sorry."

It was his AI agent

[drnb]

So you are saying that wetware has vulnerabilities too?

Nah, his AI agent did it. :-)

Re:

[93 Escort Wagon]

You joke, but that is a possibility.

Re:

[drinkypoo]

But these constant bug reports, I'm starting to think this is not true.

When you start to think, we'll let you know.

Re:This is unsettling.

[93 Escort Wagon]

During the most recent Patch Tuesday, Microsoft provided 1411 counterarguments to your statement.

Re:

[usedtobestine]

Or better (read worse) yet, someone else's IA bot did it for him.

Re:

[Anonymous Coward]

Yes, but it's impolite to tell someone making mistakes that they're hallucinating.

Re: So you are saying ...

[drinkypoo]

Usually you want to ask them whether they are on crack instead

Re:

[cellocgw]

That's why things will be so much better after AI takes over and eliminates all wetware.

Re:

[DeanonymizedCoward]

Guess they took the whole "given enough eyeballs" thing a little too seriously.

Re:

[bill_mcgonigle]

A recent psychology study suggests that heavy AI users can improve productivity and lose the ability to focus at the same time.

Forgetting which list is in the To: could be an example of diminished focus.

Pure spec.

Fun week

[EvilSS]

This is turning into a fun week for anyone in cybersecurity or just IT in general. Glad I'm taking sabbatical right now.

Re:Fun week

[93 Escort Wagon]

I think I'm gonna need a sabbatical after this week!

Re:

[TwistedGreen]

You're telling me. I was on bereavement leave this week but had to spend 3 hours pushing an emergency patch to 57 PHP servers last night. Great times.

Re:

[JimMcc]

So glad to be retired from IT before all this stuff became day-to-day.

Re:

[x_t0ken_407]

It's been especially "fun" if you work with virtulization.

JFC

[awwshit]

AI must be over-working security folks, two embargos blown in one week. Yeesh. Can't wait for more emergency patching fun.

bold choice cotton

[metac0rtex]

putting SMB code into the kernel ... but why!?

Re:

[SeaFox]

Higher performance in default config and lower memory usage compared to the userspace Samba.

Re:

[OrangAsm]

I guess someone thought the kernel needed some plumbers.

Partial mitigation with modulejail

[internet-redstar]

What a mess. For a few of these modulejail blocks the loading of these modules by regular users, who could use it for local privilege escalation. It will obviously not help for a server runnning smb direct already.