A public disclosure of several severe and unpatched vulnerabilities in the Linux kernel, some scoring as high as 9 on the CVSS security scale, has prompted recommendations for users to update to beta branches of their operating systems, including SteamOS.
The incident, reported by Phoronix, involved vulnerability reports from Trend Micro's Zero Day Initiative being mistakenly sent to a public mailing list instead of a private security list. Trend Micro's initiative is designed to encourage extended vulnerability reporting through a bug bounty system involving external researchers.
Greg Kroah-Hartman, who maintains the Linux kernel's stable branch, responded to each report, advising the submitters to correct their submission processes. The primary concern is that these vulnerabilities remain unpatched in the main kernel, leaving systems potentially open to attack following their public exposure.
However, there is positive news as some of these vulnerabilities are either undergoing testing or are already queued in beta or '-next' branches. This means users who opt into beta updates for their Linux distribution may receive patches sooner.
Phoronix has listed the following specific vulnerabilities:
- ZDI-CAN-33549: A CVSS 9.0 scored vulnerability related to SMB Direct remote code execution due to an integer underflow. A patch is reportedly in a Git branch intended for Linux v7.5, and is likely to be expedited to the mainline.
- ZDI-CAN-33774: Another CVSS 9.0 rated vulnerability involving a KSMBD race condition that could lead to remote code execution.
- ZDI-CAN-33367: A vulnerability in the network code's skbuff skb_zerocopy that could result in local privilege escalation. Linux kernel developers had already received a report on a similar issue from another source last week, and a patch is expected soon.
- ZDI-CAN-34068: A VMWGFX VMware graphics driver bug involving an out-of-bounds write, which could lead to local privilege escalation.
- ZDI-CAN-34076: An uninitialized resource in the NVMET code that could result in information disclosure.
- ZDI-CAN-32005: A search-domain TCP query stack buffer overflow leading to local privilege escalation, which was posted to the mailing list a day prior to the main batch.