Seemingly as an accident, overnight several new Linux kernel vulnerability reports were posted to the public Linux kernel mailing list rather than the private security mailing list. The vulnerabilities have yet to be patched on mainline but at least in some cases there are patches undergoing testing or queued in “-next” branches. The CVSS scores are as high as 9.0.
Trend Micro’s Zero Day Initiative sent vulnerability reports to public LKML instead of the private security list. Greg Kroah-Hartman responded to each asking about the public submission.
Disclosed issues include:
- ZDI-CAN-33549 (CVSS 9.0): SMB Direct remote code execution via integer underflow; patch in branch intended for Linux v7.5, may be expedited.
- ZDI-CAN-33774 (CVSS 9.0): KSMBD race condition leading to remote code execution.
- ZDI-CAN-33367: skbuff skb_zerocopy network code local privilege escalation; patch expected soon after prior report last week.
- ZDI-CAN-34068: VMWGFX VMware graphics driver out-of-bounds write, local privilege escalation.
- ZDI-CAN-34076: NVMET uninitialized resource information disclosure.
- ZDI-CAN-32005: search-domain TCP query stack buffer overflow, local privilege escalation (posted a day earlier).