Linux Kernel Vulnerability Exposed Before Official Mitigation
A new security concern has emerged within the Linux community, as a working exploit for a critical flaw in the Linux kernel was publicly released before it received a Common Vulnerabilities and Exposures (CVE) identifier or an upstream fix. This situation underscores the challenges of maintaining security in open-source environments.
On October 20 and 21, Trend Micro’s Zero Day Initiative (ZDI) sent out a report detailing this flaw, known as ZDI-CAN-33367, among five other vulnerabilities to various maintainers and public mailing lists. An analysis published by Sysdig’s Threat Research Team on October 24 highlighted that, at the time of their report, no in-the-wild exploitation had been reported. However, it was noted that several of these vulnerabilities still lacked fixes in any released kernel version, leaving systems at risk of potential attacks.
The Nature of the Exploit
ZDI-CAN-33367 affects the Linux networking stack and is categorized as a local privilege escalation (LPE) flaw, which ZDI assigned a high Common Vulnerability Scoring System (CVSS) score of 7.8. A local privilege escalation vulnerability can allow unprivileged users to gain enhanced permissions, thereby compromising system integrity. Specifically, this flaw allows an unprivileged user to alter in-memory contents of files they would otherwise be restricted from modifying.
Further compounding the issue, this vulnerability exists within a code path that was overlooked during the kernel’s prior fixes aimed at rectifying earlier Dirty Frag page-cache flaws. Utilizing the public proof of concept (PoC), TuxCare—a Linux support provider—demonstrated the exploit successfully, achieving root shell access on several distributions including AlmaLinux 8 through 10, CloudLinux 9 and 10, Debian 12 and 13, as well as Ubuntu 24.04 and 26.04, according to Sysdig.
Additional Vulnerabilities Identified
Aside from ZDI-CAN-33367, two additional vulnerabilities presented in the recent disclosure, namely ZDI-CAN-33774 and ZDI-CAN-33549, garnered the highest severity score of 9.0. Both of these flaws pertain to the kernel’s Server Message Block (SMB) server, known as ksmbd. The former exposes a remote pre-authentication flaw capable of leaking kernel memory and crashing systems, while the latter requires SMB Direct, a Remote Direct Memory Access (RDMA) interface equipped with a writable share.
The remaining vulnerabilities include ZDI-CAN-34068, an LPE rated 8.8, found in the kernel’s VMware graphics driver. As of the date of Sysdig’s analysis, no patch was available for this flaw, and only the title of the report was made publicly accessible. The last two vulnerabilities, ZDI-CAN-34076 and ZDI-CAN-32005, are designated as an information leak in the kernel’s Non-Volatile Memory Express (NVMe) target and a userspace stack overflow in the ConnMan network manager, respectively.
Recommendations for Mitigation
Given the fragmented patching landscape that this disclosure has produced, Sysdig recommends prioritizing mitigation efforts based on the components actively in use, rather than relying solely on CVSS scores. To enhance security, the firm suggests disabling ksmbd in environments where it is unnecessary and restricting access to port 445 to trusted networks. For those utilizing VMware guests, keeping an eye out for eventual patches related to vmwgfx is advisable.
For the specific case of ZDI-CAN-33367, Sysdig indicates that restricting unprivileged user namespaces may effectively mitigate the public proof of concept, although TuxCare has yet to validate this assertion. Notably, AlmaLinux had patches in testing by October 23, but these had not yet reached production environments.
As it stands, the public disclosure of ZDI-CAN-33367 creates a pressing need for attention, particularly due to the availability of an easy-to-use exploit. Thus, this flaw represents the most immediate concern among the vulnerabilities identified, emphasizing the criticality of prompt action in patching and securing impacted systems.