Abstract:
A security incident that caused widespread concern recently occurred in the Linux kernel development community. Multiple unpatched Linux kernel vulnerability reports that security researchers should have submitted through private channels were sent to the public Linux kernel mailing list (LKML) due to operational errors, resulting in early exposure of relevant vulnerability information.
When the incident occurred, the stable version of Linux 7.3 had just been released, and the Linux 7.4 version was still in the feature development stage. This leak has nothing to do with the previous PHP vulnerability incident that caused a large number of website administrators to urgently update, but it also caused quite a shock in the open source security community.
According to reports, Trend Micro’s Zero Day Initiative (ZDI) submitted several reports involving Linux kernel security flaws. The information was supposed to be sent to a private mailing list dedicated to security issues so developers could fix the vulnerability before it became public. However, the relevant email was mistakenly sent to the public Linux kernel mailing list, allowing all subscribers to view the vulnerability details.
After the incident was exposed, Greg Kroah-Hartman, the head of Linux kernel stable version maintenance, publicly expressed dissatisfaction and urged security researchers to improve the vulnerability submission process and avoid releasing unfixed security issues directly to public channels. Other developers and community members on the mailing list also expressed criticism and concern about the lapse.
This unexpected disclosure involves at least six vulnerabilities that have not yet been patched. Two of them are high-risk remote code execution vulnerabilities, and both received CVSS 9.0 scores. A vulnerability exists in the SMB Direct implementation, caused by an integer underflow issue, which could allow an attacker to achieve remote code execution. Another vulnerability is related to a race condition in the KSMBD component, which can also lead to remote execution of malicious code.
In addition, there are multiple vulnerabilities that may lead to privilege escalation or information disclosure. For example, the skb_zerocopy implementation in the network subsystem has security flaws and can be used for local privilege escalation; there is an out-of-bounds write problem in the VMWGFX VMware graphics driver, which may also lead to local privilege escalation; NVMET-related code has an issue with uninitialized resources, which may cause sensitive information to be leaked.
In addition, a vulnerability that has been previously sent to the mailing list involves a stack buffer overflow issue during TCP query processing and may also be exploited to achieve local privilege escalation.
Some vulnerabilities are actually in the process of being fixed. Among them, SMB Direct-related patches were originally planned to be merged during the Linux 7.5 development cycle. After this early exposure, developers may speed up the repair and release progress. Another network subsystem vulnerability has been previously reported to the kernel security team through other channels, and the relevant patch is expected to be released in the near future.
Industry insiders point out that disclosing vulnerability details in advance often increases risks. In recent years, attackers have increasingly used automated tools, reverse engineering techniques, and artificial intelligence-assisted analysis to find and exploit software vulnerabilities. Before a patch is widely deployed, publicly exposing vulnerability information may shorten the window for attackers to develop exploit code.
Currently, the Linux kernel development team is advancing related vulnerability fixes, and the actual impact of this email sending error remains to be further observed. The incident also once again highlights the importance of the security vulnerability disclosure process and the need to properly protect sensitive technical information before patches are released.
Comments