Skip to content

Back to the catalog

Several Linux kernel vulnerabilities accidentally posted to public mailing list
phoronix.comarticle

Several Linux kernel vulnerabilities accidentally posted to public mailing list

Phoronix reports that Trend Micro's Zero Day Initiative mistakenly sent several Linux kernel vulnerability reports to the public kernel mailing list instead of the private security list. They include two CVSS 9.0 remote code execution bugs (SMB Direct integer underflow, ksmbd race condition), a skb_zerocopy local privilege escalation, a vmwgfx out-of-bounds write, an NVMET information disclosure and a search-domain TCP stack buffer overflow. Some have patches in -next branches, and none were yet in mainline.

TL;DR ZDI mistakenly posted multiple unpatched Linux kernel vulnerability reports, up to CVSS 9.0, to the public LKML.
Open original ↗
Document

What it is

Trend Micro's Zero Day Initiative (ZDI) sent several Linux kernel vulnerability reports to the public kernel mailing list (LKML) instead of the private security list. Greg Kroah-Hartman replied to each report asking about the public submission. Phoronix describes it as seemingly an accident. None of the bugs were patched in mainline at the time of writing.

Affected

The page gives these ZDI tracking IDs, which the summary does not:

  • ZDI-CAN-33549: SMB Direct remote code execution from an integer underflow, CVSS 9.0.
  • ZDI-CAN-33774: ksmbd race condition leading to remote code execution, CVSS 9.0.
  • ZDI-CAN-33367: skbuff skb_zerocopy in the network code, local privilege escalation.
  • ZDI-CAN-34068: vmwgfx (VMware graphics driver) out-of-bounds write, local privilege escalation.
  • ZDI-CAN-34076: uninitialized resource in NVMET, information disclosure.
  • ZDI-CAN-32005: search-domain TCP query stack buffer overflow, local privilege escalation. This one was posted to the list a day before the others.

The page names no affected kernel versions and no CVE numbers.

What to do

The page states patch status only for two items:

  • ZDI-CAN-33549 has a patch in a Git branch of code intended for Linux v7.5. Phoronix expects it to be expedited to mainline.
  • ZDI-CAN-33367 was also reported by another source the week before, and kernel developers expect to post a patch soon.

For the other four, the page says only that some cases have patches under test or queued in "-next" branches. It does not say which. Engineers running ksmbd, vmwgfx or NVMET should track these IDs on the mailing list and in the stable trees, since details are now public before fixes are in mainline.

Caveats

The page gives no exploitability details beyond the vulnerability class and impact. It does not say whether the CVSS 9.0 scores come from ZDI or from another source, and it gives no mitigations or configuration workarounds. The claim that the posting was an accident is Phoronix's reading ("seemingly"), not a statement from ZDI.

Organisations named here

  • Greg Kroah-Hartman
  • integer underflow
  • out-of-bounds write
  • stack buffer overflow
  • ZDI-CAN-32005
  • ZDI-CAN-33367
  • ZDI-CAN-33549
  • ZDI-CAN-33774
  • ZDI-CAN-34068
  • ZDI-CAN-34076
  • Zero Day Initiative

Technologies named here

  • Trend Micro Zero Day Initiative
  • Linux kernel KSMBD
  • Linux kernel mailing list
  • Linux kernel network code, skbuff skb_zerocopy
  • Linux kernel VMWGFX VMware graphics driver
  • Linux kernel NVMET code
  • Linux kernel search-domain TCP query handling
  • Linux kernel
  • CVSS
  • Trend Micro
  • ksmbd
  • NVMe over Fabrics target
  • SMB Direct
  • VMware vmwgfx

Techniques named here

  • Remote code execution via race condition in KSMBD
  • Local privilege escalation in skbuff skb_zerocopy
  • Local privilege escalation via out-of-bounds write in VMWGFX
  • Information disclosure via uninitialized resource in NVMET
  • Race Condition

Related in Cloud & Infra