多个 Linux 内核脆弱性意外寄往公共内核邮件列表
似乎是一种事故，一夜之间，一些新的Linux内核脆弱性报告被张贴到公众的Linux内核邮件列表上，而不是私家保安邮件列表。 脆弱性尚未在主线上补丁，但至少在某些情况下，有补丁正在测试或在"-next"分支中排队。 CVSS的分数高达9.0.
Trend Micro的"零日倡议"向公众Linux内核邮件列表(LKML)发送了一些脆弱性报告，而不是典型的私人安全邮件列表。 Linux的副手Greg Kroah-Hartman回应每份报告询问他们是否被列入公开邮件名单
这些新披露的脆弱性包括：
ZDI-CAN-33549作为CVSS 9.0 得分的SMB Direct远程代码执行脆弱性由于整数下流导致的脆弱性。 对于这个，有一个补丁在一个Git分支的代码打算为Linux v7.5，但现在大概会加快到主线。
ZDI-CAN-33774作为KSMBD的种族条件，可以导致远程代码执行。 另一种CVSS 9.0 评分脆弱性。
ZDI-CAN-33367是网络代码中skbuff skb 零复制的一种挥发性，可导致本地特权升级。 Linux内核开发者上周收到来自另一个来源的同一期的安全报告，预计很快会发布一个补丁。
ZDI-CAN-34068作为VMWGFX VMware图形驱动程序bug，带有出局写法导致本地特权升级。
ZDI-CAN-34076是NVMET代码中未初始化的资源，导致信息披露。
ZDI-CAN-32005也于一天前发布在邮件列表中，用于搜索-域域TCP查询堆栈缓冲溢出导致本地特权升级。
窃听器和安保报告不断传入AI激化的世界。
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Several Linux Kernel Vulnerabilities Accidentally Posted To Public Kernel Mailing List
Seemingly as an accident, overnight several new Linux kernel vulnerability reports were posted to the public Linux kernel mailing list rather than the private security mailing list. The vulnerabilities have yet to be patched on mainline but at least in some cases there are patches undergoing testing or queued in "-next" branches. The CVSS scores are as high as 9.0.
Trend Micro's Zero Day Initiative sent out a number of vulnerability reports to the public Linux kernel mailing list (LKML) rather than the typical private security mailing list. This seemingly was a mistake with Linux's second-in-command Greg Kroah-Hartman responding to each report asking about their submission to the public mailing list.
Among these newly-disclosed vulnerabilities include:
ZDI-CAN-33549 as a CVSS 9.0 scored vulnerability for SMB Direct remote code execution vulnerability due to integer underflow. For this one there is a patch in a Git branch of code intended for Linux v7.5 but now presumably will be expedited for getting to mainline.
ZDI-CAN-33774 as a KSMBD race condition that can lead to remote code execution. Another CVSS 9.0 rated vulnerability.
ZDI-CAN-33367 is a vulneravbility for skbuff skb_zerocopy in the network code that can lead to local privilege escalation. For this one Linux kernel developers received a security report from another source last week over the same issue and a patch is expected to be posted soon.
ZDI-CAN-34068 as a VMWGFX VMware graphics driver bug with an out-of-bounds write leading to local privilege escalation.
ZDI-CAN-34076 an uninitialized resource in the NVMET code leading to information disclosure.
ZDI-CAN-32005 was also posted to the mailing list a day prior for a search-domain TCP query stack buffer overflow leading to local privilege escalation.
The bug and security reports keep on coming in the AI fueled world.
Auto-fetched and translated by AI Atlas. All rights belong to the original author.