Technology
Trend Micro reportedly posted unpatched Linux kernel flaws to public mailing list
Reports say Trend Micro's Zero Day Initiative appears to have sent several unpatched Linux kernel vulnerability reports to the public list instead of the private security list.
The short version
- Trend Micro's Zero Day Initiative appears to have accidentally posted several unpatched Linux kernel vulnerabilities to the public mailing list instead of the private security list.[Hacker News · Slashdot]
- Greg Kroah-Hartman reportedly responded to each report by asking about its submission to the public list, which was described as seemingly a mistake.[Hacker News · Slashdot]
- Two flagged flaws are rated CVSS 9.0, including an SMB Direct remote code execution bug and a KSMBD race condition.[Hacker News · Slashdot]
- Whether the posting was intentional or a mistake remains unconfirmed, with sources describing it as apparent rather than established.[Hacker News · Slashdot]
Key facts
- Trend Micro's Zero Day Initiative appears to have accidentally disclosed several unpatched Linux kernel vulnerabilities on the public LKML instead of the private security list.[Hacker News · Slashdot]
- Greg Kroah-Hartman responded to each report asking about its submission to the public mailing list.[Hacker News · Slashdot]
- ZDI-CAN-33549 is a CVSS 9.0 SMB Direct remote code execution vulnerability caused by an integer underflow.[Hacker News · Slashdot]
- ZDI-CAN-33774 is a KSMBD race condition that can lead to remote code execution and is also rated CVSS 9.0.[Hacker News · Slashdot]
What remains uncertain
- Whether the posting was a mistake is unconfirmed; sources describe it as apparent or seemingly accidental.[Hacker News · Slashdot]
Sources
Outlet counts describe coverage, not independent confirmation. Reports may share a wire service or original source.