Linux kernel vulnerabilities exposed publicly before patches are released
Trend Micro's Zero Day Initiative prematurely published reports on several high-severity Linux kernel security vulnerabilities to a public mailing list before mainline patches were made available.
FTMQ Security, written by our newsroom0 views
Trend Micro's Zero Day Initiative posted several new Linux kernel vulnerability reports to the public Linux kernel mailing list instead of the private security list. Phoronix and The Hacker News both report that the disclosures occurred before fixes were merged into the mainline Linux kernel. Phoronix reported that Linux maintainer Greg Kroah-Hartman noted the release appeared to be an accident. [1][2]
The exposed flaws carry CVSS severity scores as high as 9.0. The Hacker News reported that two of these 9.0 flaws affect KSMBD, the built-in SMB server in the Linux kernel, and allow remote code execution. One issue, identified as ZDI-CAN-33774, can be triggered prior to network authentication. A second flaw, tracked as ZDI-CAN-33549, requires the SMB Direct transport and an RDMA-capable setup. [1][2]
The Linux kernel is a free and open-source Unix-like kernel originally created by Linus Torvalds in 1991. It is widely used in computer systems and operating system distributions worldwide. [3][4]
According to Phoronix, the vulnerabilities currently lack mainline kernel patches. However, fix patches for some of the reported issues are undergoing testing or are queued in Linux next development branches. [1]
In short
- Trend Micro's Zero Day Initiative mistakenly published vulnerability reports to the public Linux kernel mailing list.
- The disclosed vulnerabilities include two remote code execution flaws in KSMBD rated 9.0 on the CVSS scale.
- Vulnerability ZDI-CAN-33774 can be triggered before any network authentication occurs.
- Mainline patches are not yet available, though fixes are undergoing testing in development branches.
Sources
Every paragraph above points to the numbered items it rests on. Read the originals here.
- [1]Several Linux Kernel Vulnerabilities Accidentally Posted To Public Kernel Mailing ListPhoronix, 18h ago (the report this story comes from)
- [2]Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel FixesThe Hacker News, 11h ago
Background
- [3]Linux on Wikipedia
- [4]Linux kernel on Wikipedia
- [5]List on Wikipedia
Our newsroom writes these reports with the help of software, from the 5 sources listed and nothing else, and checks them against those sources. Facts can still be wrong or move on; the originals are the record. Spotted a mistake? Write to daniel@monsterkong.com.
Related from FTMQ Security
Earlier reports of ours on the same people and subjects.
- Microsoft releases updates for record 1413 vulnerabilities in Patch TuesdayNation State Hacking, 7d ago
- Researchers publish local privilege escalation exploit targeting OpenBSD 7.9Top Stories, 6d ago
More in Bugs and Patches
- PHP maintainers issue emergency updates for two critical code execution vulnerabilities4h ago
- PHP releases emergency patches for two critical remote code execution flaws4h ago
- Arista fixes actively exploited VeloCloud Orchestrator zero day vulnerability4h ago
- PHP developers prepare emergency patches for two critical remote execution flaws1d ago
- Chinese state hackers exploited BeyondTrust zero-day flaw for seven weeks3d ago
- Terra Security finds sharp rise in broken software patches during 20263d ago
Get the day in one email
Reports like this one, the top news of the last 24 hours, every morning. Free, one email a day; readers can comment under every report.
By signing up you agree to our terms and privacy policy. Unsubscribe any time.
Comments
Loading
Join the conversation
Comments are open to readers of our daily email: the top news of the last 24 hours, every morning, free. Sign up and the comment box opens.
Already on the list? Enter the same address and we will send a sign-in link.
By signing up you agree to our terms and privacy policy. Unsubscribe any time.