Trend Micro made public six Linux kernel flaws before they were patched

On October 22, Greg Kroah-Hartman, one of the main maintainers of the Linux kernel, replied to several vulnerability reports, asking the same question each time. “For some reason, you sent this to public lists, without a patch,” he wrote, according to Next's translation. There are six reports. They come from the Zero Day Initiative (ZDI), Trend Micro's vulnerability research program.

According to Next and Phoronix, ZDI sent these reports on October 21 and 22 to the kernel's private security list, but with four public lists in copy: linux-kernel, linux-cifs, netdev and dri-devel. Their technical details are therefore readable by anyone. When they were published, no patch had been merged into the kernel's mainline branch.

Two flaws rated 9 out of 10 in the built-in file server

The two most serious flaws affect ksmbd, the SMB file-sharing server built into the kernel. SMB is the protocol behind Windows network shares. ksmbd is compatible with Samba but is not Samba. Both flaws are rated 9 out of 10 and could allow remote code execution:

• ZDI-CAN-33774: a burst of small SMB1 packets followed by an SMB2 packet, in the same TCP write, can cause an out-of-bounds memory write. According to Next, access to a share is enough, with no special privileges.
• ZDI-CAN-33549: an integer overflow in SMB Direct, the SMB variant that runs over remote direct memory access (RDMA) networks. The attack requires a compatible interface, a writable share and the SMB Direct option, which is disabled by default. According to Phoronix, a patch is waiting in the Linux 7.5 development branch.

The other four flaws are less serious. Three could allow privilege escalation on a machine where the attacker already has access: in the networking code (skb_zerocopy), in the graphics driver for VMware virtual machines (vmwgfx) and in ConnMan, a network connection manager. The fourth, in the NVMe target-side code (nvmet), can leak information.

A mistake, or the effect of the new AI rules?

Phoronix sees an apparent mistake. The site Cyber Kendra, cited by Next, notes that the reports credit the discoveries to TrendAI, Trend Micro's AI-based analysis tool. Yet the kernel documentation is clear: anyone who used AI to find a bug must treat it as public. The same rules ask that the proof-of-concept program be sent only if the maintainers request it. They also deem it highly desirable to propose a tested patch. According to Next, Trend Micro's reports contained none.

These rules were rewritten for Linux 7.1. Linus Torvalds has called the private list “almost entirely unmanageable” since AI tools arrived, Next reports. When Next published its article, Trend Micro had not answered its questions.

Who is affected, and what to do?

The two critical flaws only threaten machines where the ksmbd server is enabled. According to Next, patches could take several weeks. In the meantime:

• check whether the ksmbd module is loaded (for example with lsmod | grep ksmbd) and disable it if it is not needed;
• never expose an SMB share to the Internet, and restrict access to ksmbd shares to the machines that need it;
• keep SMB Direct disabled;
• follow your distribution's security bulletins and install the patched kernel as soon as it is released.

On October 14, another kernel flaw was credited to a Tencent AI. AI tools are finding more and more vulnerabilities in Linux, and kernel maintainers now also have to manage how those flaws are reported to them.