Details have been revealed and an exploit for the CIFSwitch vulnerability (CVE not yet assigned) in the CIFS kernel module and cifs-utils toolkit has been published, allowing an unprivileged user to gain root access on the system. The fix is only available as a patch, which was published on May 16 and accepted into the main branch of the Linux kernel on May 19 (corrective kernel releases are not yet available).
The vulnerability affects the code providing support for the cifs.spnego mechanism for SPNEGO (Simple and Protected GSSAPI Negotiation) authentication when connecting to SMB servers. When using cifs.spnego to derive keys from Kerberos/SPNEGO, the kernel invokes the cifs.upcall handler provided by the cifs-utils package, executed in user space with root privileges.
An unprivileged user can initiate a handler call by sending a request requiring the acquisition of the key "cifs.spnego" with a forged description "CIFS SPNEGO". The cifs.upcall handler does not perform additional validity checks on the parameters passed through the kernel, among other things it accepts values for the fields pid, uid, creduid, and
upcall_target as trustworthy. After activation, the cifs.upcall handler switches to the namespaces of the user process from which the request was sent, and performs a lookup in the NSS (Name Service Switch) system database before privilege drop.
The attacker can run their process in a separate mount namespace, which will lead to the NSS query being executed in their context. To exploit the vulnerability, it is sufficient to place their own configuration file /etc/nsswitch.conf and a set of dummy libraries libnss_*.so.2 within the environment created by the attacker. Running an NSS query by the cifs.upcall handler will lead to the loading of the substituted libraries with root privileges.
To exploit the vulnerability, user namespace or mount namespace creation must be allowed on the system, and the cifs-utils package must be installed. Affected distributions with default configuration where exploitation is possible include:
- Linux Mint Cinnamon 21.3/22.3
- CentOS Stream 9 GNOME
- Rocky Linux 9 Workstation
- Kali Linux
- AlmaLinux 9.7 Workstation
- SUSE 15 SP7/SAP 15 SP7/SAP 16
Distributions that require the installation of the cifs-utils package for the exploit to work:
- Ubuntu 18.04/20.04/22.04 Desktop/Server
- Pop!_OS 22.04 Intel/24.04 Generic
- Ubuntu 24.04 Desktop minimal/full and Server
- Debian 11/12/13 netinst standard and GNOME/KDE/standard/XFCE
- CentOS Stream 9 Cinnamon/KDE/MATE/XFCE
- Rocky Linux 9 KDE/Workstation-Lite
- openSUSE Leap 15.6 GNOME/KDE
- openSUSE Tumbleweed GNOME/KDE
- Rocky Linux 8 GenericCloud
- Oracle Linux 8/9 KVM
- Amazon Linux 2023 KVM
Distributions that, in their default configuration, apply settings that block exploitation of vulnerabilities through SELinux or Apparmor, even with the cifs-utils package present:
- Ubuntu 26.04 Desktop/Server
- Fedora 40/41/42/43/44 Workstation/Server
- CentOS Stream 10 GNOME/KDE
- Rocky Linux 10 Workstation
- AlmaLinux 10.1 Workstation
- Oracle Linux 10 KVM
- openSUSE Tumbleweed GNOME/KDE
- openSUSE Leap 16.0 OEM GNOME/KDE/Minimal-VM
- SUSE Linux 16
As a workaround for protection, the automatic loading of the cifs kernel module can be blocked:
sh -c "printf 'install cifs /bin/false\n' > /etc/modprobe.d/cifs.conf; rmmod cifs 2>/dev/null; true"
User namespace usage can also be prohibited ("sysctl -w kernel.unprivileged_userns_clone=0") and the cifs.spnego rule can be deleted or overridden in the cifs-utils configuration:
cat >/etc/request-key.d/cifs.spnego.conf <<'EOF'
create cifs.spnego * * /usr/sbin/keyctl negate %k 30 %S
EOF
Meanwhile, on May 28, 137 reports of vulnerabilities in the Linux kernel were published, and on May 27 — 277 reports.
Source: opennet.ru
