Details have been revealed and an exploit has been published for the CIFSwitch vulnerability (CVE not yet assigned) in the CIFS kernel module and the cifs-utils toolkit, allowing an unprivileged user to gain root privileges in the system. A patch is only available, which was published on May 16 and accepted into the main branch of the Linux kernel on May 19 (corrective kernel releases are still unavailable).
The vulnerability affects the code that supports the cifs.spnego mechanism for authentication via the SPNEGO (Simple and Protected GSSAPI Negotiation) protocol when connecting to SMB servers. When using cifs.spnego to derive keys from Kerberos/SPNEGO, the kernel invokes the cifs.upcall handler provided by the cifs-utils package and executed in user space with root privileges.
An unprivileged user can initiate a handler call by sending a request that requires retrieving the 'cifs.spnego' key with a forged description 'CIFS SPNEGO'. The cifs.upcall handler does not perform additional validity checks on the parameters passed through the kernel, among other things, it takes the values of the fields pid, uid, creduid, and
upcall_target as trustworthy. Once activated, the cifs.upcall handler switches to the namespaces of the user process that sent the request and before dropping privileges, it searches the system namespace NSS (Name Service Switch).
An attacker can launch their process in a separate namespace of mount points, leading to performing an NSS query in their context. To exploit the vulnerability, it is sufficient for the attacker to place their own configuration file /etc/nsswitch.conf and a set of fake libraries libnss_*.so.2 within the environment they created. Executing an NSS request by the cifs.upcall handler will lead to loading the attacker-injected libraries with root privileges.
To exploit the vulnerability, the creation of user namespaces or mount namespaces must be allowed in the system, and the cifs-utils package must be installed. Distributions in which the vulnerability can be exploited with the default configuration include:
- Linux Mint Cinnamon 21.3/22.3
- CentOS Stream 9 GNOME
- Rocky Linux 9 Workstation
- Kali Linux
- AlmaLinux 9.7 Workstation
- SUSE 15 SP7/SAP 15 SP7/SAP 16
Distributionen, für die zur Nutzung des Exploits das Paket cifs-utils installiert werden muss:
- Ubuntu 18.04/20.04/22.04 Desktop/Server
- Pop!_OS 22.04 Intel/24.04 Generic
- Ubuntu 24.04 Desktop minimal/full und Server
- Debian 11/12/13 netinst standard und GNOME/KDE/standard/XFCE
- CentOS Stream 9 Cinnamon/KDE/MATE/XFCE
- Rocky Linux 9 KDE/Workstation-Lite
- openSUSE Leap 15.6 GNOME/KDE
- openSUSE Tumbleweed GNOME/KDE
- Rocky Linux 8 GenericCloud
- Oracle Linux 8/9 KVM
- Amazon Linux 2023 KVM
Distributionen, bei denen in der Standardkonfiguration Einstellungen aktiviert sind, die die Ausnutzung der Schwachstelle durch SELinux oder Apparmor blockieren, selbst bei vorhandenen cifs-utils-Paket:
- Ubuntu 26.04 Desktop/Server
- Fedora 40/41/42/43/44 Workstation/Server
- CentOS Stream 10 GNOME/KDE
- Rocky Linux 10 Workstation
- AlmaLinux 10.1 Workstation
- Oracle Linux 10 KVM
- openSUSE Tumbleweed GNOME/KDE
- openSUSE Leap 16.0 OEM GNOME/KDE/Minimal-VM
- SUSE Linux 16
Als Umgehungsmaßnahme zum Schutz kann das automatische Laden des cifs Kernelmoduls blockiert werden:
sh -c «printf 'install cifs /bin/false\n' > /etc/modprobe.d/cifs.conf; rmmod cifs 2>/dev/null; true»
Es kann auch die Verwendung von user namespace verboten werden («sysctl -w kernel.unprivileged_userns_clone=0») und die Regel cifs.spnego in den Einstellungen von cifs-utils entfernt oder überschrieben werden:
cat >/etc/request-key.d/cifs.spnego.conf <‘EOF’
create cifs.spnego * * /usr/sbin/keyctl negate %k 30 %S
EOF
In der Zwischenzeit wurden am 28. Mai 137 Berichte über Schwachstellen im Linux-Kernel veröffentlicht, und am 27. Mai waren es 277 Berichte.
Quelle: opennet.ru
