Massive Linux Zero-Days Just Went Public (Before the Fixes)

Summary

Trend Micro’s Zero Day Initiative (ZDI) reportedly sent seven Linux kernel vulnerability reports to the public Linux Kernel Mailing List (LKML) instead of the private security list. This exposed technical details before developers had time to coordinate fixes. The posts included proof-of-concept material and reproduction instructions, giving defenders and potential attackers information about potentially vulnerable systems.

The speaker describes the usual responsible-disclosure process: report privately, develop and test fixes, and then publish details. They say this incident appeared to skip ahead to public disclosure. Greg Kroah-Hartman responded to the mailing-list posts; one reply pointed to a commit that had already fixed an issue, while the reports themselves did not include patches. The video’s account leaves the status of fixes across all seven reports unclear.

Vulnerabilities discussed

• KSMBD race condition (severity 9.0): KSMBD provides Linux file sharing over SMB. The bug could reportedly cause a response to expose about 28 bytes of kernel memory, with potential for remote code execution.
• SMB Direct/RDMA integer-handling flaw (severity 9.0): Malformed RDMA buffer descriptors could trigger an out-of-bounds kernel write, potentially enabling privileged code execution.
• SKB zerocopy permissions flaw (severity 7.8): A local user could potentially modify files without the proper permissions, amounting to local privilege escalation.

Broader concerns

The speaker speculates that AI-assisted vulnerability research may have contributed to the discoveries or the accidental batch disclosure, but emphasizes that this has not been confirmed. The broader concern is that AI may speed up vulnerability discovery faster than disclosure and patching processes can handle.

The video compares the situation with earlier Linux disclosure controversies involving Dirty Frag and Fragnesia.

Sponsor segment

A brief sponsor segment promotes Star Labs Linux laptops, highlighting preinstalled Linux, a workstation-style build, and coreboot open-source firmware. No review, guide, or tutorial is presented.

Main speaker and sources

The video’s host is SavvyNik. Sources include Trend Micro’s Zero Day Initiative reports and public LKML messages, including responses from Greg Kroah-Hartman.