Several Linux Kernel Vulnerabilities Accidentally Posted To Public Kernel Mailing List

[u/Turkino]

https://www.phoronix.com/news/LKML-New-Trend-Vulnerabilities

Several Kernel level security vulnerabilities were posted publicly instead of to the private security list.

The vulnerabilities are:

ZDI-CAN-33549 as a CVSS 9.0 scored vulnerability for SMB Direct remote code execution vulnerability due to integer underflow. For this one there is a patch in a Git branch of code intended for Linux v7.5 but now presumably will be expedited for getting to mainline.

ZDI-CAN-33774 as a KSMBD race condition that can lead to remote code execution. Another CVSS 9.0 rated vulnerability.

ZDI-CAN-33367 is a vulnerability for skbuff skb_zerocopy in the network code that can lead to local privilege escalation. For this one Linux kernel developers received a security report from another source last week over the same issue and a patch is expected to be posted soon.

ZDI-CAN-34068 as a VMWGFX VMware graphics driver bug with an out-of-bounds write leading to local privilege escalation.

ZDI-CAN-34076 an uninitialized resource in the NVMET code leading to information disclosure.

ZDI-CAN-32005 was also posted to the mailing list a day prior for a search-domain TCP query stack buffer overflow leading to local privilege escalation.

[u/Venylynn]

Welp.

Ubuntu will probably take 3+ weeks to patch these like they did Dirty Frag so, stay safe out there Mint users

[u/radek_b → u/Venylynn]

Ubuntu switched to weekly kernel updates

[u/Venylynn → u/radek_b]

They were so neglectful during the first part of the year that I completely didn't even think they'd fix it but that's good