网络安全公司趋势科技旗下的零日漏洞计划 ZDI 团队日前将多份漏洞报告抄送给公开的 Linux Kernel Mailing List，其中有两项远程代码执行漏洞的评分高达 9.0 分。这里面有部分漏洞并未修复因此不应该公开，从邮件头部信息来看应该是报告发送给内核安全团队的同时不慎抄送给公开列表。
报告中涉及五项内核漏洞：
公开报告中 ZDI-CAN-33549 描述 SMB Direct 整数下溢问题，该问题可能导致远程代码执行。报告中列出的触发环境需要启用 SMB Direct、RDMA 设备和可共享目录。
ZDI-CAN-33774 涉及内核 SMB 服务器 KSMBD 的竞态条件，这个漏洞也可能导致远程代码执行。ZDI-CAN-33549 和 33774 都属于远程代码执行类别的漏洞，CVSS 4.0 评分均为 9.0 (严重级别)。
其他报告涉及网络代码中的本地提权、VMware 虚拟显卡驱动的越界写入、NVMe 目标子系统的信息泄露。还有个 ConnMan 缓冲区溢出漏洞，不过这不是内核漏洞。
疑似是安全团队操作时失误不慎将其公开：
ZDI 的待发布通告页将上述内核漏洞报告列为 10 月 21 日通知 Linux 内核团队、计划于 2027 年 2 月 18 日公开发布漏洞细节；ConnMan 报告对应的计划公开日期为 2027 年 2 月 16 日。
而目前相关修复尚未合并到 Linux Kernel 主线版本，可以看到这纯粹是操作失误导致漏洞被提前公开，不知道提前公开这些漏洞是否会对 Linux 生态系统造成潜在的危害。
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
The ZDI team of Cyber Security's Trends Technology Zero-Day Gap Program has recently copied multiple leak reports to the public Linux Kernel Mailing List, with two remote code implementation gaps rated as high as 9.0. Some of these loopholes are not repaired and should therefore not be made public, and it appears from the head of the mail that the report should be sent to the internal nuclear safety team, while inadvertently copying the public list.
The report covers five internal nuclear loopholes:
The public report ZDI-CAN-33549 describes the spill-down of the whole SMB Direct number, which may result in remote code execution. The trigger environments listed in the report require the use of SMB Direct, RDMA devices and shared directories.
ZDI-CAN-33774 relates to competitive conditions for kernel SMB server KSMBD, a loophole that may also lead to remote code execution. Both ZDI-CAN-33549 and 33774 fall into the remote code implementation category, with the CVSS 4.0 rating being 9.0 (severe level).
Other reports relate to local rights in network codes, cross-border writing driven by VMware virtual Z114Z, and leaking information from the NVMe target subsystem. There is also a leak in the Conman buffer zone, although it is not a kernel.
It is suspected that the security team made a mistake to make it public:
The ZDI ' s pending publish notice page listed the above-mentioned internal nuclear loophole report as a notification dated 21 October to the Linux kernel team, which is scheduled to make public the details of the publish leak on 18 February 2027; the ConnMan report is intended to be open on 16 February 2027.
Now that the repairs have not been consolidated into Linux Kernel's main line version, it can be seen that it was a purely operational error that led to the early disclosure of the loopholes, and it is not clear whether the early disclosure of these loopholes would potentially harm Linux ecosystems.
Auto-fetched and translated by AI Atlas. All rights belong to the original author.