{"id":181809,"date":"2026-05-30T14:48:10","date_gmt":"2026-05-30T12:48:10","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obnarodovana-lpe-uyazvimost-cifswitch-v-linux-cifs-cifs-utils"},"modified":"2026-05-30T14:48:10","modified_gmt":"2026-05-30T12:48:10","slug":"obnarodovana-lpe-uyazvimost-cifswitch-v-linux-cifs-cifs-utils","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/obnarodovana-lpe-uyazvimost-cifswitch-v-linux-cifs-cifs-utils","title":{"rendered":"Bolestn\u00e1 LPE zranite\u013enos\u0165 CIFSwitch v Linux CIFS\/cifs-utils","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Bezpe\u010dnostn\u00fd v\u00fdskumn\u00edk <strong>Asim Manizada<\/strong> odhalil zranite\u013enos\u0165 <strong>CIFSwitch<\/strong> \u2014 lok\u00e1lne zv\u00fd\u0161enie pr\u00e1v na spojen\u00ed jadra Linux a pou\u017e\u00edvate\u013esk\u00e9ho bal\u00edka <strong>cifs-utils<\/strong>. Probl\u00e9m sa dot\u00fdka cesty spracovania <strong>CIFS\/SMB Kerberos\/SPNEGO upcall<\/strong>, teda mechanizmu, cez ktor\u00fd CIFS klient jadra \u017eiada pou\u017e\u00edvate\u013esk\u00e9ho pomocn\u00edka o \u00fadaje pre Kerberos autentifik\u00e1ciu pri montovan\u00ed SMB zdrojov. Opis bol zverejnen\u00fd po uplynut\u00ed embarga linux-distros; identifik\u00e1tor CVE nebol pri zverejnen\u00ed e\u0161te priraden\u00fd.<\/p>\n<p><noindex><noindex><\/p>\n<p><a rel=\"nofollow\" href=\"https:\/\/almalinux.org\/blog\/2026-05-28-cifswitch\/\">Podstata zranite\u013enosti spo\u010d\u00edva v tom<\/a>, \u017ee nemprivilegovan\u00fd pou\u017e\u00edvate\u013e mohol vyvola\u0165 request_key(&quot;cifs.spnego&quot;, &#8230;) a odovzda\u0165 fal\u0161ovan\u00fd popis k\u013e\u00fa\u010da. V norm\u00e1lnom scen\u00e1ri by tak\u00fdto riadok mal vytvori\u0165 samotn\u00fd CIFS klient jadra: obsahuje inform\u00e1cie o serveri, UID, credential UID, PID, cie\u013eovom upcalli a \u010fal\u0161\u00edch parametroch. Av\u0161ak jadro nekontrolovalo, \u010di popis naozaj poch\u00e1dza z CIFS subsyst\u00e9mu, a cifs.upcall, sp\u00fa\u0161\u0165an\u00fd z rootu cez \u0161tandardn\u00e9 pravidlo request-key, d\u00f4veroval t\u00fdmto poliam ako \u00fadajom, ktor\u00e9 vytvorilo jadro.<\/p>\n<p><\/noindex><\/noindex><\/p>\n<p><noindex><\/p>\n<p><a rel=\"nofollow\" href=\"https:\/\/www.openwall.com\/lists\/oss-security\/2026\/05\/28\/2\">Zranite\u013enos\u0165 nie je univerz\u00e1lna<\/a> \"diery v akomko\u013evek Linuxe z krabice\". Na exek\u00faciu musia s\u00fahlasi\u0165 viacer\u00e9 podmienky: existencia zranite\u013en\u00e9ho jadra, nain\u0161talovan\u00fd cifs-utils s pravidlom cifs.spnego, schopnos\u0165 neopr\u00e1vnen\u00fdch pou\u017e\u00edvate\u013eov vytv\u00e1ra\u0165 user\/mount namespaces, ako aj absencia blokovania zo strany SELinux, AppArmor alebo inej politiky LSM. V spr\u00e1ve na oss-security je osobitne uveden\u00e9, \u017ee na zranite\u013en\u00fdch syst\u00e9moch to poskytuje cestu od neopr\u00e1vnen\u00e9ho miestneho pou\u017e\u00edvate\u013ea k vykonaniu k\u00f3du ako root.<\/p>\n<p><\/noindex><br \/>\n<noindex><\/p>\n<p>Technicky <a rel=\"nofollow\" href=\"https:\/\/blog.cloudlinux.com\/cifswitch-mitigation-and-kernel-update\">re\u0165azec je postaven\u00fd na tom<\/a>, \u017ee cifs.upcall m\u00f4\u017ee prejs\u0165 do priestorov n\u00e1zvov uveden\u00fdch vo fal\u0161ovanom popise a vykona\u0165 NSS dopyt pred kone\u010dn\u00fdm zru\u0161en\u00edm pr\u00e1v. V d\u00f4sledku toho m\u00f4\u017ee prostredie ovl\u00e1dan\u00e9 \u00fato\u010dn\u00edkom ovplyvni\u0165 na\u010d\u00edtanie NSS modulu root procesom. Vo verejn\u00fdch opisoch sa zd\u00f4raz\u0148uje, \u017ee ide presne o logick\u00fa chybu na hranici jadra a pou\u017e\u00edvate\u013esk\u00e9ho priestoru, a nie klasick\u00fa zranite\u013enos\u0165 sp\u00f4soben\u00fa korupciou pam\u00e4te.<\/p>\n<p><\/noindex><\/p>\n<p>Oprava v jadre bola men\u0161ia: pre typ k\u013e\u00fa\u010dov cifs.spnego bola pridan\u00e1 kontrola, ktor\u00e1 odmieta popisy vytvoren\u00e9 nie samotn\u00fdm CIFS klientom s jeho s\u00fakromn\u00fdmi spnego_cred. Tento pr\u00edstup uzatv\u00e1ra triedu \u00fatokov bez nutnosti synchronizovan\u00fdch zmien v cifs-utils, aj ke\u010f autor upozor\u0148uje, \u017ee je st\u00e1le \u017eiaduce dodato\u010dn\u00e9 posilnenie u\u017e\u00edvate\u013esk\u00e9ho priestoru.<\/p>\n<p><noindex><\/p>\n<p><a rel=\"nofollow\" href=\"https:\/\/almalinux.org\/blog\/2026-05-28-cifswitch\/\">AlmaLinux ozn\u00e1mil<\/a>, \u017ee z\u00e1kladn\u00e1 logika je pr\u00edtomn\u00e1 vo v\u0161etk\u00fdch podporovan\u00fdch vydaniach AlmaLinuxu a AlmaLinux 8, 9, 10 a Kitten 10 s\u00fa pova\u017eovan\u00e9 za postihnut\u00e9 pri nain\u0161talovanom cifs-utils. Opraven\u00e9 jadr\u00e1 boli pripraven\u00e9 v testing-repozit\u00e1roch: pre AlmaLinux 9 je uveden\u00fd bal\u00edk kernel-5.14.0-687.5.4.el9_8 alebo nov\u0161\u00ed, pre AlmaLinux 10 \u2014 kernel-6.12.0-211.7.4.el10_2 alebo nov\u0161\u00ed.<\/p>\n<p><\/noindex><\/p>\n<p>Ako do\u010dasn\u00e9 opatrenia pred in\u0161tal\u00e1ciou opraven\u00e9ho jadra sa odpor\u00fa\u010da odstr\u00e1ni\u0165 cifs-utils, ak sa na syst\u00e9me nepou\u017e\u00edva SMB\/CIFS klient, zak\u00e1za\u0165 na\u010d\u00edtanie modulu cifs, predefinova\u0165 pravidlo cifs.spnego v request-key alebo zak\u00e1za\u0165 nepriviligovan\u00e9 u\u017e\u00edvate\u013esk\u00e9 namespace. Tieto obch\u00e1dzaj\u00face opatrenia m\u00f4\u017eu naru\u0161i\u0165 Kerberos autentifik\u00e1ciu pre CIFS mont\u00e1\u017ee, tak\u017ee na serveroch, kde sa re\u00e1lne pou\u017e\u00edvaj\u00fa Kerberos autentifikovan\u00e9 SMB zdie\u013eania, je potrebn\u00e9 ich aplikova\u0165 opatrne.<\/p>\n<p>CIFSwitch je zauj\u00edmav\u00fd aj kontextom objavenia: autor ho opisuje ako v\u00fdsledok vyh\u013ead\u00e1vania viacstup\u0148ov\u00fdch re\u0165azcov s vyu\u017eit\u00edm LLM a grafov\u00e9ho zobrazenia vz\u0165ahov medzi bezpe\u010dnostn\u00fdmi objektmi. Ale praktick\u00fd z\u00e1ver pre administr\u00e1torov je celkom zrozumite\u013en\u00fd: skontrolova\u0165 pr\u00edtomnos\u0165 cifs-utils, stav u\u017e\u00edvate\u013esk\u00fdch namespaces a aktualiz\u00e1cie jadra, najm\u00e4 na syst\u00e9moch, kde s\u00fa lok\u00e1lni pou\u017e\u00edvatelia alebo kontajnerov\u00e9 skripty s roz\u0161\u00edren\u00fdmi mo\u017enos\u0165ami namespaces.<\/p>\n<p>Zdroj: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.linux.org.ru\/news\/security\/18305995\">linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Asim Manizada \u0440\u0430\u0441\u043a\u0440\u044b\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CIFSwitch \u2014 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0435 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 \u0441\u0432\u044f\u0437\u043a\u0435 \u044f\u0434\u0440\u0430 Linux \u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430 cifs-utils. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043f\u0443\u0442\u044c \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 CIFS\/SMB Kerberos\/SPNEGO upcall, \u0442\u043e \u0435\u0441\u0442\u044c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c, \u0447\u0435\u0440\u0435\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0439 CIFS-\u043a\u043b\u0438\u0435\u043d\u0442 \u044f\u0434\u0440\u0430 \u0437\u0430\u043f\u0440\u0430\u0448\u0438\u0432\u0430\u0435\u0442 \u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0433\u043e helper\u2019\u0430 \u0434\u0430\u043d\u043d\u044b\u0435 \u0434\u043b\u044f Kerberos-\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u0440\u0438 \u043c\u043e\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0438 SMB-\u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432. \u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043e \u043f\u043e\u0441\u043b\u0435 \u0438\u0441\u0442\u0435\u0447\u0435\u043d\u0438\u044f \u044d\u043c\u0431\u0430\u0440\u0433\u043e linux-distros; \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 CVE \u043d\u0430 \u043c\u043e\u043c\u0435\u043d\u0442 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0435\u0449\u0451 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-181809","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.5 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Asim Manizada \u0440\u0430\u0441\u043a\u0440\u044b\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CIFSwitch \u2014 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0435 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 \u0441\u0432\u044f\u0437\u043a\u0435 \u044f\u0434\u0440\u0430 Linux \u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430 cifs-utils.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Erik Peterson\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sk\/blog\/news\/obnarodovana-lpe-uyazvimost-cifswitch-v-linux-cifs-cifs-utils\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.5\" \/>\n\t\t<meta property=\"og:locale\" content=\"sk_SK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041e\u0431\u043d\u0430\u0440\u043e\u0434\u043e\u0432\u0430\u043d\u0430 LPE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CIFSwitch \u0432 Linux CIFS\/cifs-utils | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Asim Manizada \u0440\u0430\u0441\u043a\u0440\u044b\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CIFSwitch \u2014 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0435 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 \u0441\u0432\u044f\u0437\u043a\u0435 \u044f\u0434\u0440\u0430 Linux \u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430 cifs-utils.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sk\/blog\/news\/obnarodovana-lpe-uyazvimost-cifswitch-v-linux-cifs-cifs-utils\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-05-30T12:48:10+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-05-30T12:48:10+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zverejnen\u00e1 LPE zranite\u013enos\u0165 CIFSwitch v Linux CIFS\/cifs-utils | ProHoster","description":"Bezpe\u010dnostn\u00fd v\u00fdskumn\u00edk Asim Manizada odhalil zranite\u013enos\u0165 CIFSwitch \u2014 lok\u00e1lne zv\u00fd\u0161enie opr\u00e1vnen\u00ed v spojen\u00ed jadra Linux a u\u017e\u00edvate\u013esk\u00fd bal\u00edk cifs-utils.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/obnarodovana-lpe-uyazvimost-cifswitch-v-linux-cifs-cifs-utils","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043d\u0430\u0440\u043e\u0434\u043e\u0432\u0430\u043d\u0430 LPE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CIFSwitch \u0432 Linux CIFS\/cifs-utils | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Asim Manizada \u0440\u0430\u0441\u043a\u0440\u044b\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CIFSwitch \u2014 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0435 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 \u0441\u0432\u044f\u0437\u043a\u0435 \u044f\u0434\u0440\u0430 Linux \u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430 cifs-utils.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/obnarodovana-lpe-uyazvimost-cifswitch-v-linux-cifs-cifs-utils","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-30T12:48:10+00:00","article:modified_time":"2026-05-30T12:48:10+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/181809","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=181809"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/181809\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=181809"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=181809"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=181809"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}