Seemingly as an accident, overnight several new Linux kernel vulnerability reports were posted to the public Linux kernel mailing list rather than the private security mailing list. The vulnerabilities have yet to be patched on mainline but at least in some cases there are patches undergoing testing or queued in “-next” branches. The CVSS scores are as high as 9.0.
Trend Micro’s Zero Day Initiative sent out a number of vulnerability reports to the public Linux kernel mailing list (LKML) rather than the typical private security mailing list. This seemingly was a mistake with Linux’s second-in-command Greg Kroah-Hartman responding to each report asking about their submission to the public mailing list.
Among these newly-disclosed vulnerabilities include:
ZDI-CAN-33549 as a CVSS 9.0 scored vulnerability for SMB Direct remote code execution vulnerability due to integer underflow. For this one there is a patch in a Git branch of code intended for Linux v7.5 but now presumably will be expedited for getting to mainline.
ZDI-CAN-33774 as a KSMBD race condition that can lead to remote code execution. Another CVSS 9.0 rated vulnerability.
ZDI-CAN-33367 is a vulneravbility for skbuff skb_zerocopy in the network code that can lead to local privilege escalation. For this one Linux kernel developers received a security report from another source last week over the same issue and a patch is expected to be posted soon.
ZDI-CAN-34068 as a VMWGFX VMware graphics driver bug with an out-of-bounds write leading to local privilege escalation.
ZDI-CAN-34076 an uninitialized resource in the NVMET code leading to information disclosure.
ZDI-CAN-32005 was also posted to the mailing list a day prior for a search-domain TCP query stack buffer overflow leading to local privilege escalation.
The bug and security reports keep on coming in the AI fueled world.
Two SMB issues, showing again that it was a really stupid idea to put a network filesystem/filesharing that belongs into userspace in the kernel.
Honesty is the best policy??
So what are the consequences? No internet for my machine today, I guess?
What a week
Captain, it’s Friday.
God damnit
This seemingly was a mistake with Linux’s second-in-command Greg Kroah-Hartman responding to each report asking about their submission to the public mailing list.
I hope that was not AI automation, with him being a lover and a loud public advocate of it.
EDIT: we’ve misread the text. It wasn’t a mistake by Greg, but merely that he was the one to reply. Nobody directed Trend Micro to the public mailing list, they did it by themselves (as far as we know).
with him being a lover and a loud public advocate of it.
I googled the guy’s name and as expected, I found him suggesting ai is good for finding bugs now, unlike in the past. No quotes of him praising its use let alone across the board.
I am generally against AI but what exactly is the point of opposing it to the point of denying it has any use whatsoever, exaggerating anything anyone says remotely in favor of it, or in this case making up harm that AI hypothetically may have caused? Doing things like that is just destroying the credibility of opposing AI, and I see this kind of approach to it constantly on here.
No, Linux is not “vibecoded” now. No, Torvalds is not an AI simp now. Yes, there are some uses of AI that are probably worth the downsides (which anyone can see and should admit to). Binary thinking is not productive.
What does it have to with Kroah-Hartmans stance on AI when it wasn’t him that made the mistake?
This here was the mistake that Kroah-Hartman was questioning:
Trend Micro’s Zero Day Initiative sent out a number of vulnerability reports to the public Linux kernel mailing list (LKML) rather than the typical private security mailing list.
What does it have to with Kroah-Hartmans stance on AI when it wasn’t him that made the mistake?
Because any mistakes he does is of cause due to some AI glitch, that proves that he is wrong about saying anything positive about AI, and it could never be something else. Well, beside that it wasn’t him that posted to the wrong mailing list.
As other replies to you have touched on, I believe you’ve misread/misunderstood that, although I understand why. It definitely could’ve been worded more clearly.
What it means is more along the lines of:
This seemingly was a mistake. Linux’s second-in-command Greg Kroah-Hartman responded to each report asking about their submission to the public mailing list.
He’s not the one that submitted them. He’s the one that replied to them asking “wtf!?”
Ah that makes sense, i was reading that in the wrong way as well and was wondering how that fuckup would even happen
Thank you for the clarification! That makes more sense honestly. Indeed I have read it differently at first.
Trend Micro’s Zero Day Initiative sent out a number of vulnerability reports to the public Linux kernel mailing list
why? I really hope it was! so much funnier
I’d bet it was. And love has nothing to do with AI in the kernel. He’s on the payroll of techbros, of course he’d be an AI advocator.
