If you're an enlightened sort, who has sought out the sunny uplands of a Linux operating system for your gaming rig in these exciting days of almost seamless game compatibility, then you might want to have a think about migrating your OS onto a beta branch for a while. A list of as-yet unpatched Linux kernel vulnerabilities has been sent out to a public mailing list by accident, and some of these issues score as high as 9 on the CVSS security-scare-o-meter.
The incident was reported by Phoronix yesterday, where Michael Larabel noted that overnight several new vulnerability reports had gone to a public rather than private security mailing list. The reports had seemingly come from Trend Micro's Zero Day Initiative—an initiative set up to promote extended vulnerability reporting (.pdf warning) with a bug bounty system extending to a group of external researchers.
I guess sometimes a group can be too extended.
Anyways, the list of vulnerabilities was jumped on by what Phoronix calls Linux's second-in-command, Greg Kroah-Hartman, who maintains the stable branch of the kernel. Kroah-Hartman responded to each of the reports individually asking them to fix their submission process.
Mostly because none of these vulnerabilities have been patched on the main kernel yet, and remain open to attack. And those attack vectors have just been made public. Eep. The more positive news, however, is that some of the cases are undergoing testing or are at least queued in beta or '-next' branches.
So there is a chance that your chosen distro might have those patches in place for the security conscious if you opt-in to a beta branch for an update. Worth a check, eh?
Phoronix lists these vulnerabilities as:
- ZDI-CAN-33549 as a CVSS 9.0 scored vulnerability for SMB Direct remote code execution vulnerability due to integer underflow. For this one there is a patch in a Git branch of code intended for Linux v7.5 but now presumably will be expedited for getting to mainline.
- ZDI-CAN-33774 as a KSMBD race condition that can lead to remote code execution. Another CVSS 9.0 rated vulnerability.
- ZDI-CAN-33367 is a vulnerability for skbuff skb_zerocopy in the network code that can lead to local privilege escalation. For this one Linux kernel developers received a security report from another source last week over the same issue and a patch is expected to be posted soon.
- ZDI-CAN-34068 as a VMWGFX VMware graphics driver bug with an out-of-bounds write leading to local privilege escalation.
- ZDI-CAN-34076 an uninitialized resource in the NVMET code leading to information disclosure.
- ZDI-CAN-32005 was also posted to the mailing list a day prior for a search-domain TCP query stack buffer overflow leading to local privilege escalation.