{"id":151538,"date":"2025-12-14T11:11:58","date_gmt":"2025-12-14T09:11:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-utilite-smb4k-pozvolyayushhaya-poluchit-prava-root-v-sisteme"},"modified":"2025-12-14T11:11:58","modified_gmt":"2025-12-14T09:11:58","slug":"uyazvimost-v-utilite-smb4k-pozvolyayushhaya-poluchit-prava-root-v-sisteme","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-utilite-smb4k-pozvolyayushhaya-poluchit-prava-root-v-sisteme","title":{"rendered":"Vulnerability in the smb4k utility allowing root access to the system","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Vulnerabilities have been discovered in the smb4k utility used in KDE for detecting and mounting SMB shares, allowing for root access to the system. The issues have been addressed in the Smb4K 4.0.5 release. You can check the status of the new package version or the availability of a fix in the following distributions: Debian, Ubuntu, Fedora, SUSE\/openSUSE, Gentoo, Arch, and FreeBSD. <\/p>\n
To perform privileged actions in smb4k, KAuth handlers are used, which run with root privileges. Vulnerabilities exist in the Smb4KMountHelper handler caused by the fact that the mounting (CVE-2025-66003) and unmounting (CVE-2025-66002) functions did not properly filter the options passed to the mount.cifs and unmount.cifs commands, allowing an unprivileged user to pass any options to these commands through the mh_options parameter. <\/p>\n
For instance, using the options «filemode=04777,uid=0», all files in the mounted partition will have the suid root flag set. The user can run an SMB server and mount their own partition with the necessary executables, which, when the options «filemode=04777,uid=0» are set, will execute with root privileges. <\/p>\n
The Smb4KMountHelper handler also did not properly validate the target directories, which, for example, allowed a user to mount their SMB share in place of the \/bin directory and substitute it with a modified version of \/bin\/bash. Additionally, through the mh_krb5ticket parameter, it is possible to change the path to the Kerberos credential file and achieve output of any file's content, such as \/etc\/shadow, to stderr or a publicly accessible log. <\/p>\n
A vulnerability in the function Smb4KMountHelper::unmount() can be exploited to cause a denial of service by unmounting system partitions, manipulating the content of the parameter mh_mountpoint. Interestingly, the code included a check for the partition type, which only allowed cifs, smbfs, and smb3 partitions, but in the if-block for error output, the «return» statement was omitted, causing execution to continue. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"