Vulnerabilities have been discovered in the smb4k utility used in KDE for detecting and mounting SMB shares, allowing for root access to the system. The issues have been addressed in the Smb4K 4.0.5 release. You can check the status of the new package version or the availability of a fix in the following distributions: Debian, Ubuntu, Fedora, SUSE/openSUSE, Gentoo, Arch, and FreeBSD.
To perform privileged actions in smb4k, KAuth handlers are used, which run with root privileges. Vulnerabilities exist in the Smb4KMountHelper handler caused by the fact that the mounting (CVE-2025-66003) and unmounting (CVE-2025-66002) functions did not properly filter the options passed to the mount.cifs and unmount.cifs commands, allowing an unprivileged user to pass any options to these commands through the mh_options parameter.
For example, using the options "filemode=04777,uid=0" will set the suid root flag on all files in the mounted share. A user could start an SMB server and mount their own share containing the necessary executable files, which would execute with root privileges when the options "filemode=04777,uid=0" are set.
The Smb4KMountHelper handler also did not properly validate the target directories, which, for example, allowed a user to mount their SMB share in place of the /bin directory and substitute it with a modified version of /bin/bash. Additionally, through the mh_krb5ticket parameter, it is possible to change the path to the Kerberos credential file and achieve output of any file's content, such as /etc/shadow, to stderr or a publicly accessible log.
The vulnerability in the Smb4KMountHelper::unmount() function can be exploited to trigger a denial of service by unmounting system partitions by manipulating the mh_mountpoint parameter. Interestingly, the code contained a check for the partition type that only allowed cifs, smbfs, and smb3 partitions, but the error output block missed the 'return' statement, and execution continued.
Source: opennet.ru
