Critical Trend Micro ZDI Linux Vulnerabilities Leaked on LKML
According to a recent Phoronix report, several new Linux kernel vulnerability reports from Trend Micro’s Zero Day Initiative (ZDI) have been inadvertently published to the public Linux Kernel Mailing List (LKML). This apparent accidental disclosure occurred before some of the issues were merged into the Linux mainline kernel. Fortunately, remediation strategies for several of these flaws are already present in testing or release candidate branches.
Scope of the Affected Subsystems
These newly revealed vulnerabilities span multiple critical subsystems within the Linux kernel. The affected areas include network communication, file sharing, virtualized graphics drivers, and storage services. Most notably, the SMB Direct-related vulnerability, designated ZDI-CAN-33549, and the KSMBD-related flaw, ZDI-CAN-33774, both carry a severe CVSS score of 9.0. Consequently, they present a substantial risk of remote code execution.
Specific Threat Vectors Identified
Another significant vulnerability, ZDI-CAN-33367, involves the skb_zerocopy function within the networking code. Malicious actors could potentially exploit this flaw for local privilege escalation. Reports indicate that kernel developers had previously received security notifications regarding this specific issue through alternative channels. Therefore, the community anticipates a remedial patch will be submitted shortly.
Furthermore, the VMWGFX virtualized graphics driver for VMware harbors ZDI-CAN-34068, an out-of-bounds write vulnerability that could also facilitate local privilege escalation. Additionally, ZDI-CAN-34076, located within the NVMET code, involves an uninitialized resource that could ultimately lead to sensitive information disclosure.
Stack Buffer Overflow and Mitigation Status
The public mailing list leak also included a vulnerability report labeled ZDI-CAN-32005. This particular issue involves a stack buffer overflow during the processing of search domain TCP queries. Similarly, this flaw could result in local privilege escalation.
The progress of remediation varies significantly across the different vulnerabilities. While developers have integrated some fixes into development or testing workflows, this does not guarantee that all affected systems are currently protected against these threats.
Standard Security Protocols and Disclosure
The standard security handling procedures for the Linux kernel project mandate a strict protocol. Researchers must prioritize submitting unpublicized security vulnerabilities directly to the relevant subsystem maintainers and the core kernel security team. This secure approach facilitates coordinated remediation efforts before the vulnerability details become public knowledge.
The official kernel security documentation explicitly advises researchers on proper disclosure methods. When uncertainty exists regarding whether a vulnerability is suitable for public disclosure, researchers should always default to private reporting channels. Currently, the specific reasons behind this accidental mailing list disclosure remain unconfirmed.
