{"id":181796,"date":"2026-05-29T14:48:11","date_gmt":"2026-05-29T12:48:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/cifswitch-uyazvimost-v-cifs-podsisteme-yadra-linux-pozvolyayushhaya-poluchit-prava-root"},"modified":"2026-05-29T14:48:11","modified_gmt":"2026-05-29T12:48:11","slug":"cifswitch-uyazvimost-v-cifs-podsisteme-yadra-linux-pozvolyayushhaya-poluchit-prava-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/de\/blog\/news\/cifswitch-uyazvimost-v-cifs-podsisteme-yadra-linux-pozvolyayushhaya-poluchit-prava-root","title":{"rendered":"CIFSwitch \u2014 eine Sicherheitsanf\u00e4lligkeit im CIFS-Subsystem des Linux-Kernels, die es erm\u00f6glicht, Root-Rechte zu erlangen.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Details have been revealed and an exploit has been published for the CIFSwitch vulnerability (CVE not yet assigned) in the CIFS kernel module and the cifs-utils toolkit, allowing an unprivileged user to gain root privileges in the system. A patch is only available, which was published on May 16 and accepted into the main branch of the Linux kernel on May 19 (corrective kernel releases are still unavailable). <\/p>\n

The vulnerability affects the code that supports the cifs.spnego mechanism for authentication via the SPNEGO (Simple and Protected GSSAPI Negotiation) protocol when connecting to SMB servers. When using cifs.spnego to derive keys from Kerberos\/SPNEGO, the kernel invokes the cifs.upcall handler provided by the cifs-utils package and executed in user space with root privileges. <\/p>\n

Ein nicht privilegierter Benutzer kann einen Handler-Aufruf initiieren, indem er eine Anfrage sendet, die den Schl\u00fcssel «cifs.spnego» verlangt, mit einer gef\u00e4lschten Beschreibung «CIFS SPNEGO». Im cifs.upcall-Handler werden keine zus\u00e4tzlichen \u00dcberpr\u00fcfungen der Korrektheit der \u00fcber den Kernel \u00fcbergebenen Parameter durchgef\u00fchrt; unter anderem werden die vertrauensw\u00fcrdigen Werte der Felder pid, uid, creduid und
\n upcall_target as trustworthy. Once activated, the cifs.upcall handler switches to the namespaces of the user process that sent the request and before dropping privileges, it searches the system namespace NSS (Name Service Switch).<\/p>\n

An attacker can launch their process in a separate namespace of mount points, leading to performing an NSS query in their context. To exploit the vulnerability, it is sufficient for the attacker to place their own configuration file \/etc\/nsswitch.conf and a set of fake libraries libnss_*.so.2 within the environment they created. Executing an NSS request by the cifs.upcall handler will lead to loading the attacker-injected libraries with root privileges.<\/p>\n

To exploit the vulnerability, the creation of user namespaces or mount namespaces must be allowed in the system, and the cifs-utils package must be installed. Distributions in which the vulnerability can be exploited with the default configuration include:<\/p>\n