Linux Kernel Vulnerabilities Accidentally Dumped Onto Public LKML

Overnight, several fresh reports of Linux kernel vulnerabilities turned up on the public kernel mailing list (LKML) — exactly where they were not supposed to be. By all appearances it was a mistake: the messages were meant for the private security list.

The reports came from Trend Micro's Zero Day Initiative, which routed them to the open list rather than the usual private channel. The slip-up is underscored by the reaction of Greg Kroah-Hartman, the kernel's second-in-command, who replied to each report asking why it had been posted publicly.

Some of the flaws had not been fixed in mainline at the time of disclosure, though for several the patches are already in testing or queued in the "-next" branches.

What was disclosed

• ZDI-CAN-33549 (CVSS 9.0) — remote code execution in SMB Direct caused by an integer underflow. A patch already sits in a Git branch aimed at Linux 7.5, but it will now presumably be expedited into mainline.
• ZDI-CAN-33774 (CVSS 9.0) — a KSMBD race condition that can lead to remote code execution.
• ZDI-CAN-33367 — a flaw in the networking code's skb_zerocopy that can lead to local privilege escalation. Kernel developers received a separate report of the same issue last week, and a patch is expected soon.
• ZDI-CAN-34068 — an out-of-bounds write in the VMware graphics driver (VMWGFX) leading to local privilege escalation.
• ZDI-CAN-34076 — an uninitialized resource in the NVMET code resulting in information disclosure.
• ZDI-CAN-32005 — a stack buffer overflow in search-domain TCP query handling that enables local privilege escalation; this one landed on the list a day earlier.

The flow of bug and security reports, it seems, shows no sign of slowing in an AI-fueled world.

Source: Phoronix