Trend Micro accidentally exposed Linux kernel bugs with 9.0 severity on a public mailing list
Several Linux kernel vulnerabilities accidentally posted to public mailing list
Trend Micro's Zero Day Initiative sent several unpatched Linux kernel vulnerability reports to the public Linux kernel mailing list instead of the private security channel. Greg Kroah-Hartman replied to each one asking why they went public. The flaws include two CVSS 9.0 bugs — an SMB Direct integer underflow enabling remote code execution and a KSMBD race condition — plus local privilege escalation and information disclosure issues, some with patches still queued for mainline.
The bug and security reports keep on coming in the AI fueled world.
- wongarsu
Doesn't the Linux kernel encourage reporting on the public mailing list for kernel vulnerabilities that were found using AI? If I remember correctly they introduced that policy after the security mailing list got swamped with multiple reports for the same vulnerabilities
- lynndotpy
Still bleary eyed, but: Most severe ones are in SMB and KSMBD, which apparently have implementations in kernel space. I think this doesn't impact anyone not using KMB.
Others are LPEs, but two have been deleted by now, so can't be sure of the details.
TrendMicro's site opens up with a big big "Advancing AI-Native Security with Anthropic". Which checks out I guess.
- dayofthedaleks
The headline should include Trend Micro's name for shaming purposes. Amatuerish.
- jeanpah
Do You guys think that with ai we Will achieve something like a bug free os distro or programming language? Like some sort of perfection?
- extraextra
What an entertaining season in the simulation