A smb4k utility used in KDE for detecting and mounting SMB shares has vulnerabilities that allow for root access to the system. The issues have been resolved in the release of Smb4K 4.0.5. You can check the status of the new package version or patch preparation in the distributions on the following pages: Debian, Ubuntu, Fedora, SUSE/openSUSE, Gentoo, Arch, and FreeBSD.
To perform privileged actions in smb4k, KAuth handlers are used, which run with root privileges. Vulnerabilities exist in the Smb4KMountHelper handler and are caused by the fact that the functions for mounting (CVE-2025-66003) and unmounting (CVE-2025-66002) the network file system did not properly filter the options passed to the mount.cifs and unmount.cifs commands, allowing an unprivileged user to pass any options to these commands via the mh_options parameter.
For example, using the options "filemode=04777,uid=0" will set the suid root flag on all files in the mounted share. A user can run an SMB server and mount their own share containing necessary executable files, which will execute with root privileges when using the options "filemode=04777,uid=0".
The Smb4KMountHelper handler also did not properly check the target directories, which, for example, allowed a user to mount their SMB share instead of the /bin directory and replace it with a modified version of /bin/bash. Additionally, through the mh_krb5ticket parameter, one can change the path to the Kerberos credentials file and obtain the contents of any file, for example, /etc/shadow, to stderr or a publicly accessible log.
A vulnerability in the Smb4KMountHelper::unmount() function can be exploited to cause a denial of service by unmounting system partitions while manipulating the mh_mountpoint parameter. Interestingly, the code included a check for the partition type that only passed cifs, smbfs, and smb3 partitions, but in the if block for error output, the "return" statement was omitted, and execution was not halted.
Forrás: opennet.ru
