Unpatched Linux kernel vulnerabilities with CVSS 9.0 scores exposed on public mailing list
Trend Micro's Zero Day Initiative accidentally posted multiple unpatched Linux kernel vulnerabilities to the public LKML instead of the private security list, including two CVSS 9.0 remote code execution flaws.
Summary
Several Linux kernel vulnerability reports were mistakenly sent to the public Linux kernel mailing list rather than the private security mailing list. The disclosed flaws include two CVSS 9.0-rated remote code execution vulnerabilities in SMB Direct and KSMBD. None have been patched in mainline yet, though some fixes are in testing or queued for future releases. Greg Kroah-Hartman responded to each report questioning the public disclosure.
The disclosed vulnerabilities
- ZDI-CAN-33549: SMB Direct integer underflow enabling remote code execution (CVSS 9.0); patch exists in a branch targeting Linux v7.5
- ZDI-CAN-33774: KSMBD race condition leading to remote code execution (CVSS 9.0)
- ZDI-CAN-33367: skbuff skb_zerocopy network code bug enabling local privilege escalation; duplicate report received last week, patch expected soon
- ZDI-CAN-34068: VMWGFX VMware graphics driver out-of-bounds write causing local privilege escalation
- ZDI-CAN-34076: Uninitialized resource in NVMET leading to information disclosure
- ZDI-CAN-32005: TCP query stack buffer overflow in search-domain code enabling local privilege escalation
Why it matters
The premature public disclosure of unpatched high-severity kernel vulnerabilities gives attackers advance notice before fixes reach distributions. The SMB-related RCE flaws are particularly concerning for systems running file sharing services.
What to do
- Monitor for mainline Linux kernel updates as patches for these vulnerabilities are currently undergoing testing or are queued in '-next' branches.
- Users of SMB Direct should look for the patch intended for Linux v7.5 to address the ZDI-CAN-33549 remote code execution vulnerability.
Original reference: www.phoronix.com →