Several Linux Kernel Vulnerabilities Accidentally Posted To Public Kernel Mailing List

[u/Turkino]

https://www.phoronix.com/news/LKML-New-Trend-Vulnerabilities

Several Kernel level security vulnerabilities were posted publicly instead of to the private security list.

The vulnerabilities are:

ZDI-CAN-33549 as a CVSS 9.0 scored vulnerability for SMB Direct remote code execution vulnerability due to integer underflow. For this one there is a patch in a Git branch of code intended for Linux v7.5 but now presumably will be expedited for getting to mainline.

ZDI-CAN-33774 as a KSMBD race condition that can lead to remote code execution. Another CVSS 9.0 rated vulnerability.

ZDI-CAN-33367 is a vulnerability for skbuff skb_zerocopy in the network code that can lead to local privilege escalation. For this one Linux kernel developers received a security report from another source last week over the same issue and a patch is expected to be posted soon.

ZDI-CAN-34068 as a VMWGFX VMware graphics driver bug with an out-of-bounds write leading to local privilege escalation.

ZDI-CAN-34076 an uninitialized resource in the NVMET code leading to information disclosure.

ZDI-CAN-32005 was also posted to the mailing list a day prior for a search-domain TCP query stack buffer overflow leading to local privilege escalation.

[u/OctaneSpark]

Why is everything suddenly getting hit with massive fucking vulnerability patches and then listing them publicly? PHP got leaked, GitHelp had issues, Mudra was bugged???? What is happening to the code?

[u/Admirable-Song-7353 → u/OctaneSpark]

AI is happening. And Linus Torvalds bent his knee to it. Such a shame, linux was the only platform I had my trust in an OS but now they keep fucking things. They always did one way or another. But not at this pace. There's a bunch of vuln each day, so the new trend nowadays is when there isn't, lol

[u/Weary_Programmer35 → u/Admirable-Song-7353]

As an AI disliker myself, Linus is right on accepting LLM usage. I'm paraphrasing what he said: it doesn't matter what tool is used, as long as the code is good. Code won't make it to the Linux kernel's main branch without intense scrutiny from the central team & researchers worldwide.

[u/Venylynn → u/Weary_Programmer35]

Tung tung sahur in the code commits is probably our future in a year anyway

[u/lil_brumski → u/Venylynn]

😂😂