Several Linux kernel vulnerabilities accidentally posted to public mailing list
Security Slip-up: Linux Kernel Flaws Leaked to Public Mailing List
In a surprising turn of events, several reports detailing vulnerabilities within the Linux kernel were inadvertently shared with the general public. Instead of following the standard protocol of utilizing the private security mailing list, these disclosures were sent directly to the Linux Kernel Mailing List (LKML).
"Seemingly as an accident, overnight several new Linux kernel vulnerability reports were posted to the public Linux kernel mailing list rather than the private security mailing list."
The Incident Overview
The reports were submitted by Trend Micro's Zero Day Initiative (ZDI). The error was quickly noticed by Greg Kroah-Hartman, the second-in-command for Linux kernel development, who responded to the threads questioning why these sensitive reports were being broadcast to a public forum.
Reporting Workflow Error
The following diagram illustrates the deviation from the intended security disclosure process:
Detailed Vulnerability Breakdown
While these flaws have not yet been integrated into the mainline kernel, some fixes are currently being tested or are sitting in the -next branches.
Summary Table of Disclosures
| Identifier | Component | Impact | Primary Cause |
|---|---|---|---|
ZDI-CAN-33549 | SMB Direct | Remote Code Execution (RCE) | Integer Underflow |
ZDI-CAN-33774 | KSMBD | Remote Code Execution (RCE) | Race Condition |
ZDI-CAN-33367 | Network Code | Local Privilege Escalation (LPE) | skb_zerocopy issue |
ZDI-CAN-34068 | VMWGFX | Local Privilege Escalation (LPE) | Out-of-bounds Write |
ZDI-CAN-34076 | NVMET | Information Disclosure | Uninitialized Resource |
ZDI-CAN-32005 | TCP Query | Local Privilege Escalation (LPE) | Stack Buffer Overflow |
Deep Dive into Specific Flaws
- Critical SMB Vulnerability:
ZDI-CAN-33549is particularly severe, carrying a risk score of: This flaw allows for remote code execution via an integer underflow. A patch currently exists in a Git branch for Linux v7.5, though it will likely beslow-rolledexpedited into the mainline kernel. - Network & Driver Issues:
ZDI-CAN-33367affects theskbuffskb_zerocopyfunction. Interestingly, developers had already received a separate report on this same issue last week; a patch is imminent.ZDI-CAN-34068involves the VMware graphics driver (VMWGFX), where an out-of-bounds write can lead to LPE.
- Other Leaks:
ZDI-CAN-34076involves theNVMETcode, leading to the exposure of sensitive information.ZDI-CAN-32005(posted a day earlier) involves a stack buffer overflow during search-domain TCP queries.
Current Patching Status
The development team is working through the backlog. The current status of the fixes is as follows:
- Identify leaked reports
- Acknowledge reports via Greg Kroah-Hartman
- Merge all patches into mainline
- Verify fixes in
-nextbranches
Final Thoughts
As Michael Larabel notes, the volume of security reports continues to climb, potentially accelerated by the current AI-fueled landscape of software analysis.
About the Author: Michael Larabel is the founder and principal writer of Phoronix.com (est. 2004). He is a specialist in Linux hardware, performance, and graphics drivers, and the creator of the Phoronix Test Suite.
# Example of how one might check kernel version for vulnerability context
uname -a