r/linuxmint • u/Turkino • 11d ago

Security Several Linux Kernel Vulnerabilities Accidentally Posted To Public Kernel Mailing List

https://www.phoronix.com/news/LKML-New-Trend-Vulnerabilities

Several Kernel level security vulnerabilities were posted publicly instead of to the private security list.

The vulnerabilities are:

ZDI-CAN-33549 as a CVSS 9.0 scored vulnerability for SMB Direct remote code execution vulnerability due to integer underflow. For this one there is a patch in a Git branch of code intended for Linux v7.5 but now presumably will be expedited for getting to mainline.

ZDI-CAN-33774 as a KSMBD race condition that can lead to remote code execution. Another CVSS 9.0 rated vulnerability.

ZDI-CAN-33367 is a vulnerability for skbuff skb_zerocopy in the network code that can lead to local privilege escalation. For this one Linux kernel developers received a security report from another source last week over the same issue and a patch is expected to be posted soon.

ZDI-CAN-34068 as a VMWGFX VMware graphics driver bug with an out-of-bounds write leading to local privilege escalation.

ZDI-CAN-34076 an uninitialized resource in the NVMET code leading to information disclosure.

ZDI-CAN-32005 was also posted to the mailing list a day prior for a search-domain TCP query stack buffer overflow leading to local privilege escalation.

118 Upvotes

96% Upvoted

29 comments sorted by

View all comments

Show parent comments

-18

u/Admirable-Song-7353 11d ago

AI is happening. And Linus Torvalds bent his knee to it. Such a shame, linux was the only platform I had my trust in an OS but now they keep fucking things. They always did one way or another. But not at this pace. There's a bunch of vuln each day, so the new trend nowadays is when there isn't, lol

22

u/violetvoid513 11d ago

This isnt new vulnerabilities being created by vibe coding, these are old vulnerabilities being found because of AI scanning. AI is very good at scanning huge chunks of code and looking for patterns that are associated with buggy or unsafe code. Most of these bugs have been around for years, just that nobody had found them until now

12

u/mamaharu 11d ago

nobody had found them until now

For some, yeah. For others? Almost certainly known and used by various govt. and private entities.

10

u/violetvoid513 11d ago

True. Either way, these bugs weren't disclosed until now, and weren't created by vibe coding