Details have been disclosed and an exploit has been published for a CIFSwitch vulnerability (CVE not yet assigned) in the CIFS kernel module and cifs-utils toolkit. This vulnerability allows an unprivileged user to gain root privileges on the system. The fix is only available as a patch, which was published on May 16 and accepted into the mainline kernel on May 19. Linux (kernel maintenance releases are not yet available).
The vulnerability affects code that supports the cifs.spnego mechanism for performing authentication via the SPNEGO (Simple and Protected GSSAPI Negotiation) protocol when connecting to SMB servers. When using cifs.spnego to determine Kerberos/SPNEGO keys, the kernel calls the cifs.upcall handler, which is provided by the cifs-utils package and runs in user space with root privileges.
An unprivileged user can initiate a call to the handler by sending a request requesting the "cifs.spnego" key with a fake "CIFS SPNEGO" description. The cifs.upcall handler does not perform additional validation checks on parameters passed through the kernel; among other things, it treats the pid, uid, creduid, and
upcall_target. Once activated, the cifs.upcall handler switches to the namespaces of the user process through which the request was sent and performs a search in the system's NSS (Name Service Switch) database before resetting privileges.
An attacker can launch their process in a separate mount point namespace, which will cause NSS to be accessed in their context. To exploit this vulnerability, simply place their own configuration file /etc/nsswitch.conf and a set of dummy libraries, libnss_*.so.2, within the attacker's created environment. Executing an NSS request by the cifs.upcall handler will load the dummy libraries with root privileges.
To exploit this vulnerability, the system must allow user namespaces or mount points, and the cifs-utils package must be installed. Distributions that can exploit this vulnerability in their default configuration include:
- Linux Mint Cinnamon 21.3/22.3
- CentOS Stream 9 GNOME
- Rocky Linux 9 Workstation
- Time Linux
- AlmaLinux 9.7 Workstation
- SUSE 15 SP7/SAP 15 SP7/SAP 16
Distributions that require the cifs-utils package to work with the exploit:
- Ubuntu 18.04/20.04/22.04 Desktop/Server
- Pop!_OS 22.04 Intel/24.04 Generic
- Ubuntu 24.04 Desktop minimal/full and Server
- Debian 11/12/13 netinst standard and GNOME/KDE/standard/XFCE
- CentOS Stream 9 Cinnamon/KDE/MATE/XFCE
- Rocky Linux 9 KDE/Workstation-Lite
- openSUSE Leap 15.6 GNOME/KDE
- openSUSE Tumbleweed GNOME/KDE
- Rocky Linux 8 GenericCloud
- Oracle Linux 8/9 KVM
- Amazon Linux 2023 KVM
Distributions that have default configurations that block exploitation of vulnerabilities through SELinux or Apparmor, even if the cifs-utils package is present:
- Ubuntu 26.04 Desktop/Server
- Fedora 40/41/42/43/44 Workstation/Server
- CentOS Stream 10 GNOME/KDE
- Rocky Linux 10 Workstation
- AlmaLinux 10.1 Workstation
- Oracle Linux 10 KVM
- openSUSE Tumbleweed GNOME/KDE
- openSUSE Leap 16.0 OEM GNOME/KDE/Minimal-VM
- SUSE Linux 16
As a workaround, you can block the automatic loading of the cifs kernel module:
sh -c "printf 'install cifs /bin/false\n' > /etc/modprobe.d/cifs.conf; rmmod cifs 2>/dev/null; true"
You can also disable the use of user namespace ("sysctl -w kernel.unprivileged_userns_clone=0") and remove or override the cifs.spnego rule in the cifs-utils settings:
cat >/etc/request-key.d/cifs.spnego.conf <'EOF'
create cifs.spnego * * /usr/sbin/keyctl negate %k 30 %S
EOF
Meanwhile, 137 kernel vulnerability reports were published on May 28. Linux, and for May 27 - 277 reports.
Source: opennet.ru
