{"id":181809,"date":"2026-05-30T14:48:10","date_gmt":"2026-05-30T12:48:10","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obnarodovana-lpe-uyazvimost-cifswitch-v-linux-cifs-cifs-utils"},"modified":"2026-05-30T14:48:10","modified_gmt":"2026-05-30T12:48:10","slug":"obnarodovana-lpe-uyazvimost-cifswitch-v-linux-cifs-cifs-utils","status":"publish","type":"post","link":"https:\/\/prohoster.info\/lv\/blog\/news\/obnarodovana-lpe-uyazvimost-cifswitch-v-linux-cifs-cifs-utils","title":{"rendered":"Atkl\u0101ta LPE ievainojam\u012bba CIFSwitch Linux CIFS\/cifs-utils","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Dro\u0161\u012bbas p\u0113tnieks <strong>Asim Manizada<\/strong> atkl\u0101ja ievainojam\u012bbu <strong>CIFSwitch<\/strong> \u2014 lok\u0101la privile\u0123iju paaugstin\u0101\u0161ana Linux kodola un lietot\u0101ja pakotnes savienojum\u0101 <strong>cifs-utils<\/strong>. Probl\u0113ma skar apstr\u0101des ce\u013cu <strong>CIFS\/SMB Kerberos\/SPNEGO upcall<\/strong>, proti, meh\u0101nismu, ar kuru CIFS kodola klients pieprasa no lietot\u0101ja pal\u012bga datus Kerberos autentifik\u0101cijai SMB resursu mont\u0101\u017eas laik\u0101. Apraksts tika public\u0113ts p\u0113c linux-distros embargo beigu; CVE identifikators public\u0113\u0161anas br\u012bd\u012b v\u0113l nebija pie\u0161\u0137irts.<\/p>\n<p><noindex><noindex><\/p>\n<p><a rel=\"nofollow\" href=\"https:\/\/almalinux.org\/blog\/2026-05-28-cifswitch\/\">Ievainojam\u012bbas b\u016bt\u012bba ir<\/a>, ka nepietiekam\u0101 statusa lietot\u0101js var\u0113ja izsaukt request_key(&quot;cifs.spnego&quot;, &#8230;) un nodot viltotu atsl\u0113gas aprakstu. Parast\u0101 scen\u0101rij\u0101 \u0161\u0101du rindu vajadz\u0113tu izveidot pa\u0161am CIFS kodola klientam: taj\u0101 ir inform\u0101cija par serveri, UID, akredit\u0101cijas UID, PID, upcall m\u0113r\u0137i un citiem parametriem. Tom\u0113r kodols nep\u0101rbaud\u012bja, vai apraksts tie\u0161\u0101m n\u0101ca no CIFS apak\u0161sist\u0113mas, un cifs.upcall, ko palai\u017e root, izmantojot standarta request-key noteikumu, uztic\u0113j\u0101s \u0161iem laukiem k\u0101 datiem, ko izveidojis kodols.<\/p>\n<p><\/noindex><\/noindex><\/p>\n<p><noindex><\/p>\n<p><a rel=\"nofollow\" href=\"https:\/\/www.openwall.com\/lists\/oss-security\/2026\/05\/28\/2\">Ievainojam\u012bba nav univers\u0101la<\/a> \u00abcaurums jebkur\u0101 Linux no kastes\u00bb. Lai to izmantotu, j\u0101past\u0101v vair\u0101kiem nosac\u012bjumiem: j\u0101b\u016bt ievainojamam kodolam, instal\u0113tiem cifs-utils ar cifs.spnego noteikumu, iesp\u0113jai nepietiekam\u0101m lietot\u0101jiem izveidot user\/mount namespaces, k\u0101 ar\u012b j\u0101b\u016bt neesot blo\u0137\u0113\u0161anai no SELinux, AppArmor vai citas LSM politikas. Zi\u0146ojum\u0101 oss-security atsevi\u0161\u0137i nor\u0101d\u012bts, ka ievainojam\u0101s sist\u0113m\u0101s tas nodro\u0161ina ce\u013cu no nepietiekam\u0101 lok\u0101l\u0101 lietot\u0101ja uz koda izpildi k\u0101 root.<\/p>\n<p><\/noindex><br \/>\n<noindex><\/p>\n<p>Tehniski <a rel=\"nofollow\" href=\"https:\/\/blog.cloudlinux.com\/cifswitch-mitigation-and-kernel-update\">\u0137\u0113de veidojas ap to<\/a>, ka cifs.upcall var p\u0101riet uz nosaukumiem, kas nor\u0101d\u012bti viltotaj\u0101 aprakst\u0101, un veikt NSS piepras\u012bjumu pirms privile\u0123iju piln\u012bgas atcel\u0161anas. T\u0101 rezult\u0101t\u0101 uzbruc\u0113ja kontrol\u0113ta vide var ietekm\u0113t NSS modu\u013ca iel\u0101di root proces\u0101. Publiskos aprakstos uzsv\u0113rts, ka tas ir tie\u0161i lo\u0123iska k\u013c\u016bda kodola un lietot\u0101ja telpas robe\u017e\u0101, nevis klasisk\u0101 atmi\u0146as korupcijas ievainojam\u012bba.<\/p>\n<p><\/noindex><\/p>\n<p>Labojums kodol\u0101 bija neliels: uz cifs.spnego atsl\u0113gu tipam tika pievienota p\u0101rbaude, kas noraida aprakstus, kurus izveidojis pats CIFS klients ar sav\u0101m priv\u0101taj\u0101m spnego_cred. \u0160\u0101ds pieejas veids sl\u0113dz uzbrukumu klasi bez oblig\u0101t\u0101m sinhron\u0101m izmai\u0146\u0101m cifs-utils, lai gan autors atz\u012bm\u0113, ka papildu nostiprin\u0101\u0161ana lietot\u0101ja telp\u0101 joproj\u0101m ir v\u0113lama.<\/p>\n<p><noindex><\/p>\n<p><a rel=\"nofollow\" href=\"https:\/\/almalinux.org\/blog\/2026-05-28-cifswitch\/\">AlmaLinux zi\u0146oja<\/a>, ka pamatlo\u0123ija ir kl\u0101teso\u0161a vis\u0101s atbalst\u012btaj\u0101s AlmaLinux versij\u0101s, un AlmaLinux 8, 9, 10 un Kitten 10 tiek uzskat\u012btas par ietekm\u0113t\u0101m, ja ir uzst\u0101d\u012bts cifs-utils. Labot\u0101s kodolu versijas ir sagatavotas testing-repozitorijos: AlmaLinux 9 nor\u0101d\u012bts pakotne kernel-5.14.0-687.5.4.el9_8 vai jaun\u0101ka, AlmaLinux 10 \u2014 kernel-6.12.0-211.7.4.el10_2 vai jaun\u0101ka.<\/p>\n<p><\/noindex><\/p>\n<p>K\u0101 pagaidu pas\u0101kums pirms labota kodola uzst\u0101d\u012b\u0161anas ieteicams no\u0146emt cifs-utils, ja sist\u0113m\u0101 netiek izmantots SMB\/CIFS klients, aizliegt cifs modu\u013ca iel\u0101di, p\u0101rrakst\u012bt cifs.spnego noteikumu request-key vai atsl\u0113gt nepilnvarotos lietot\u0101ju namespace. \u0160ie apgrie\u0161anas pas\u0101kumi var saboj\u0101t Kerberos autentifik\u0101ciju CIFS mont\u0101\u017e\u0101m, t\u0101p\u0113c serveros, kur tiek re\u0101li izmantoti Kerberos autentific\u0113ti SMB koplieto\u0161anas resursi, tie j\u0101pielieto uzman\u012bgi.<\/p>\n<p>CIFSwitch ir interesanta ar\u012b konteksta atkl\u0101\u0161anas d\u0113\u013c: autors to apraksta k\u0101 daudzso\u013cu \u0137\u0113\u017eu mekl\u0113\u0161anas rezult\u0101tu, izmantojot LLM un objektu dro\u0161\u012bbas saik\u0146u grafisku att\u0113lojumu. Bet praktiskais secin\u0101jums administratoriem ir pavisam piezem\u0113ts: p\u0101rbaud\u012bt cifs-utils pieejam\u012bbu, lietot\u0101ju namespaces st\u0101vokli un kodola atjaunin\u0101jumus, it \u012bpa\u0161i sist\u0113m\u0101s, kur ir viet\u0113jie lietot\u0101ji vai konteineru skripti ar papla\u0161in\u0101t\u0101m namespace iesp\u0113j\u0101m.<\/p>\n<p>Avots: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.linux.org.ru\/news\/security\/18305995\">linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Asim Manizada \u0440\u0430\u0441\u043a\u0440\u044b\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CIFSwitch \u2014 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0435 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 \u0441\u0432\u044f\u0437\u043a\u0435 \u044f\u0434\u0440\u0430 Linux \u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430 cifs-utils. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043f\u0443\u0442\u044c \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 CIFS\/SMB Kerberos\/SPNEGO upcall, \u0442\u043e \u0435\u0441\u0442\u044c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c, \u0447\u0435\u0440\u0435\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0439 CIFS-\u043a\u043b\u0438\u0435\u043d\u0442 \u044f\u0434\u0440\u0430 \u0437\u0430\u043f\u0440\u0430\u0448\u0438\u0432\u0430\u0435\u0442 \u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0433\u043e helper\u2019\u0430 \u0434\u0430\u043d\u043d\u044b\u0435 \u0434\u043b\u044f Kerberos-\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u0440\u0438 \u043c\u043e\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0438 SMB-\u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432. \u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043e \u043f\u043e\u0441\u043b\u0435 \u0438\u0441\u0442\u0435\u0447\u0435\u043d\u0438\u044f \u044d\u043c\u0431\u0430\u0440\u0433\u043e linux-distros; \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 CVE \u043d\u0430 \u043c\u043e\u043c\u0435\u043d\u0442 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0435\u0449\u0451 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-181809","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.5 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Asim Manizada \u0440\u0430\u0441\u043a\u0440\u044b\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CIFSwitch \u2014 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0435 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 \u0441\u0432\u044f\u0437\u043a\u0435 \u044f\u0434\u0440\u0430 Linux \u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430 cifs-utils.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Erik Peterson\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/lv\/blog\/news\/obnarodovana-lpe-uyazvimost-cifswitch-v-linux-cifs-cifs-utils\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.5\" \/>\n\t\t<meta property=\"og:locale\" content=\"lv_LV\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041e\u0431\u043d\u0430\u0440\u043e\u0434\u043e\u0432\u0430\u043d\u0430 LPE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CIFSwitch \u0432 Linux CIFS\/cifs-utils | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Asim Manizada \u0440\u0430\u0441\u043a\u0440\u044b\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CIFSwitch \u2014 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0435 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 \u0441\u0432\u044f\u0437\u043a\u0435 \u044f\u0434\u0440\u0430 Linux \u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430 cifs-utils.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/lv\/blog\/news\/obnarodovana-lpe-uyazvimost-cifswitch-v-linux-cifs-cifs-utils\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-05-30T12:48:10+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-05-30T12:48:10+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Public\u0113ta LPE ievainojam\u012bba CIFSwitch Linux CIFS\/cifs-utils | ProHoster","description":"Dro\u0161\u012bbas p\u0113tnieks Asim Manizada atkl\u0101jis CIFSwitch ievainojam\u012bbu \u2014 viet\u0113jo privil\u0113\u0123iju paaugstin\u0101\u0161anu Linux kodola un lietot\u0146u pakotnes cifs-utils kombin\u0101cij\u0101.","canonical_url":"https:\/\/prohoster.info\/lv\/blog\/news\/obnarodovana-lpe-uyazvimost-cifswitch-v-linux-cifs-cifs-utils","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"lv_LV","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043d\u0430\u0440\u043e\u0434\u043e\u0432\u0430\u043d\u0430 LPE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CIFSwitch \u0432 Linux CIFS\/cifs-utils | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Asim Manizada \u0440\u0430\u0441\u043a\u0440\u044b\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CIFSwitch \u2014 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0435 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 \u0441\u0432\u044f\u0437\u043a\u0435 \u044f\u0434\u0440\u0430 Linux \u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430 cifs-utils.","og:url":"https:\/\/prohoster.info\/lv\/blog\/news\/obnarodovana-lpe-uyazvimost-cifswitch-v-linux-cifs-cifs-utils","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-30T12:48:10+00:00","article:modified_time":"2026-05-30T12:48:10+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/181809","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/comments?post=181809"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/181809\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/media?parent=181809"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/categories?post=181809"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/tags?post=181809"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}