Security Researcher Asim Manizada disclosed a vulnerability CIFSwitch — a local privilege escalation issue in the Linux kernel and user-space package cifs-utils. The problem affects the processing path of CIFS/SMB Kerberos/SPNEGO upcall, which is the mechanism through which the kernel's CIFS client requests data for Kerberos authentication from a user-space helper when mounting SMB resources. The description was published after the linux-distros embargo expired; the CVE identifier had not yet been assigned at the time of publication.
The essence of the vulnerability is that, an unprivileged user could invoke request_key("cifs.spnego", …) and pass a forged key description. In a normal scenario, such a string should be formed by the CIFS client in the kernel: it contains information about the server, UID, credential UID, PID, the goal of the upcall, and other parameters. However, the kernel did not check that the description actually came from the CIFS subsystem, and cifs.upcall, executed by root through the standard request-key rule, trusted these fields as data created by the kernel.
The vulnerability is not a universal "hole in any Linux out of the box." Several conditions must be met for exploitation: a vulnerable kernel, cifs-utils installed with the cifs.spnego rule, the ability for unprivileged users to create user/mount namespaces, and the absence of blocking by SELinux, AppArmor, or another LSM policy. The oss-security message specifically noted that in vulnerable systems, this allows a path for unprivileged local users to execute code as root.
Technically, the chain revolves around the fact that cifs.upcall can transition into the namespaces specified in the forged description and execute an NSS request before the final drop of privileges. As a result, an attacker-controlled environment can influence the loading of an NSS module by the root process. Public descriptions emphasize that this is a logical error at the boundary between the kernel and user space, rather than a classic memory corruption vulnerability.The fix in the kernel turned out to be small: for the cifs.spnego key type, a check was added that rejects descriptions not created by the CIFS client itself with its private spnego_cred. This approach closes the class of attacks without mandatory synchronous changes in cifs-utils, although the author notes that additional hardening in user space is still desirable.
AlmaLinux reported
AlmaLinux has announced, the basic logic is present in all supported releases of AlmaLinux, with AlmaLinux 8, 9, 10, and Kitten 10 considered affected when cifs-utils is installed. Patched kernels have been prepared in the testing repositories: for AlmaLinux 9, the package kernel-5.14.0-687.5.4.el9_8 or newer is specified, and for AlmaLinux 10 — kernel-6.12.0-211.7.4.el10_2 or newer.
As a temporary measure before installing the patched kernel, it is suggested to remove cifs-utils if the SMB/CIFS client is not used on the system, prohibit loading the cifs module, override the cifs.spnego rule in request-key, or disable unprivileged user namespaces. These workarounds may break Kerberos authentication for CIFS mounts, so they should be applied cautiously on servers where Kerberos-authenticated SMB shares are actively used.
CIFSwitch is also interesting due to the detection context: the author describes it as the result of searching through multi-step chains using LLM and a graph representation of relationships between security objects. But the practical takeaway for administrators is quite straightforward: check for the presence of cifs-utils, the status of user namespaces, and kernel updates, especially on systems with local users or container scripts utilizing advanced namespace features.
Source: linux.org.ru
