Trend Micro ZDI accidentally leaks unpatched Linux kernel vulnerabilities

Trend Micro’s Zero Day Initiative (ZDI) accidentally exposed several unpatched, high-severity Linux kernel vulnerabilities by sending reports to the public Linux Kernel Mailing List (LKML) instead of a private security list.

The leak includes at least six vulnerabilities, with CVSS severity scores of 9.0 or higher. Notable flaws include a vulnerability in the KSMBD module (ZDI-CAN-33774) that allows for remote code execution, and an integer overflow in SMB Direct (ZDI-CAN-33549) which also enables remote code execution.

Linux kernel maintainer Greg Kroah-Hartman expressed significant frustration regarding the error, calling for immediate corrections to the reporting process. While the leak presents a major opportunity for attackers, the immediate risk is concentrated on specific hardware, such as NAS servers and home servers utilizing the KSMBD module with port 445 exposed to untrusted networks.