{"id":181796,"date":"2026-05-29T14:48:11","date_gmt":"2026-05-29T12:48:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/cifswitch-uyazvimost-v-cifs-podsisteme-yadra-linux-pozvolyayushhaya-poluchit-prava-root"},"modified":"2026-05-29T14:48:11","modified_gmt":"2026-05-29T12:48:11","slug":"cifswitch-uyazvimost-v-cifs-podsisteme-yadra-linux-pozvolyayushhaya-poluchit-prava-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/nl\/blog\/news\/cifswitch-uyazvimost-v-cifs-podsisteme-yadra-linux-pozvolyayushhaya-poluchit-prava-root","title":{"rendered":"CIFSwitch \u2014 een kwetsbaarheid in de CIFS-subsys van de Linux-kernel die root-rechten kan verkrijgen","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Details have been revealed and an exploit has been published for the CIFSwitch vulnerability (CVE not yet assigned) in the CIFS kernel module and the cifs-utils toolkit, allowing an unprivileged user to gain root rights in the system. The fix is only available as a patch, which was published on May 16 and accepted into the main branch of the Linux kernel on May 19 (corrective kernel releases are not yet available). <\/p>\n

The vulnerability affects the code that provides support for the cifs.spnego mechanism for authentication via the SPNEGO (Simple and Protected GSSAPI Negotiation) protocol when connecting to SMB servers. When using cifs.spnego to determine keys from Kerberos\/SPNEGO, the kernel invokes the cifs.upcall handler, provided by the cifs-utils package and executed in user space with root rights. <\/p>\n

Een niet-geprivilegieerde gebruiker kan een oproep naar de handler initi\u00ebren door een verzoek te sturen waarin gevraagd wordt om de sleutel «cifs.spnego», met een valse beschrijving «CIFS SPNEGO». In de cifs.upcall handler worden geen extra controles op de geldigheid van de parameters uitgevoerd die via de kernel zijn doorgegeven; onder andere beschouwt deze vertrouwde waarden voor de velden pid, uid, creduid en
\n upcall_target as trustworthy. Once activated, the cifs.upcall handler switches into the namespaces of the user process that sent the request, and before privilege drop, it searches the NSS (Name Service Switch) system database.<\/p>\n

An attacker can launch their process in a separate mount namespace, leading to the NSS request being executed in their context. To exploit the vulnerability, it is sufficient for the attacker to place their own configuration file \/etc\/nsswitch.conf and a set of spoofed libraries libnss_*.so.2 in the environment they created. Executing an NSS request by the cifs.upcall handler will lead to loading the spoofed libraries with root rights.<\/p>\n

To exploit the vulnerability, the system must allow the creation of user namespaces or mount namespaces, and the cifs-utils package must be installed on the system. The distributions where the vulnerability can be exploited with the default configuration include:<\/p>\n