eMudhra logins can be bruteforced
eMudhra login systems are vulnerable to brute-force attacks, risking unauthorized access. Users should implement stronger security measures to protect their accounts. (mastodon.catgirl.cloud)
Several Linux kernel vulnerabilities accidentally posted to public mailing list
phoronix.com226 points74 comments
Trend Micro's Zero Day Initiative accidentally posted multiple Linux kernel vulnerability reports to the public Linux kernel mailing list instead of the private security list, exposing high-severity bugs before they reached mainline fixes. Several reports carry CVSS scores as high as 9.0 and include ZDI-CAN-33549 (SMB Direct integer underflow enabling remote code execution), ZDI-CAN-33774 (KSMBD race condition enabling remote code execution), ZDI-CAN-33367 (skbuff skb_zerocopy network bug enabling local privilege escalation), ZDI-CAN-34068 (VMWGFX out-of-bounds write enabling local privilege escalation), ZDI-CAN-34076 (uninitialized resource in NVMET leading to information disclosure), and ZDI-CAN-32005 (search-domain TCP query stack buffer overflow causing local privilege escalation). Linux maintainers, including Greg Kroah-Hartman, publicly queried the submissions; some patches already exist in a Git branch intended for Linux v7.5 or are queued in “-next,” while others are under development or testing.
The disclosures affect diverse subsystems - SMB, KSMBD, network skbuff, VMware graphics, NVMET, and TCP handling - and include both remote code execution and privilege-escalation vectors, representing significant risk until fixes are merged into mainline. One issue had already been reported to developers from another source and a patch is expected soon. Public posting accelerates awareness and potential exploitation, increasing pressure on maintainers to prioritize, test, and backport fixes to protect deployed systems.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
More in Security
How to spot AI science slop
AI-generated science content often contains factual errors and signs like formatting and inhuman mistakes. Recognizing these signs helps verify the accuracy of AI-produced information, especially in scientific contexts. (labmuffin.com)
Utah Woman Speaks Out After Cop Body Slammed Her at Data Center Protest
A Utah woman was forcibly body-slammed by a police officer during a protest against a data center. The incident has sparked outrage and calls for accountability. (commondreams.org)
It's Time to Take Starlink Away from Elon Musk
Paul Krugman argues that Elon Musk's decision to cut off Ukraine's Starlink access was an overreach that compromised U.S. national security and aided Russia. He emphasizes that private individuals should not have the power to make foreign policy decisions, especially during wartime. (paulkrugman.substack.com)
Iceye and Nokia partner with Ukraine to develop satcom capability
Iceye and Nokia are partnering with Ukraine's Ministry of Defence to develop sovereign satellite communication capabilities. The collaboration aims to enhance Ukraine's defense, border security, and disaster response through secure European satellite systems. (iceye.com)
Lawsuits Can't Restrain Big Tech
Lawsuits against tech giants like Alphabet and Meta have resulted in minimal penalties that fail to limit their growing power. Organized efforts for regulation and public control are seen as the only means to effectively restrain these monopolies. (jacobin.com)