A newly disclosed Linux vulnerability nicknamed CIFSwitch may allow a local, unprivileged user to gain root privileges on some Linux systems.

The issue affects the interaction between the Linux kernel’s CIFS/SMB client and the user-space cifs-utils authentication helper. CIFS is commonly used to mount SMB/Windows-style network shares on Linux systems. The vulnerability is most relevant on systems where CIFS/SMB support and cifs-utils are installed, especially where Kerberos/SPNEGO authentication support is present.

What is the vulnerability?

CIFSwitch is a local privilege escalation vulnerability. It does not allow remote exploitation by itself. An attacker generally needs local access to the system first, such as a shell account, compromised web user, compromised container context, or another foothold.

The vulnerability involves forged cifs.spnego key requests. Under vulnerable conditions, an unprivileged user can trigger the normal CIFS authentication workflow and cause the root-run cifs.upcall helper to trust attacker-controlled fields. The public technical analysis describes an exploit chain involving namespace switching and Name Service Switch behavior before privileges are dropped, which can result in root code execution.

Who may be affected?

The vulnerability is not universal, but several common Linux distributions or configurations may be affected.

Affected or potentially affected environments include combinations of:

• A vulnerable Linux kernel
• cifs-utils, particularly systems where the cifs.upcall helper is present
• CIFS/SMB client functionality enabled or available
• Unprivileged user namespaces enabled
• SELinux, AppArmor, or other local security policies that do not block the exploit path

Public reporting and vendor advisories indicate that this issue can affect multiple Linux distributions depending on package versions, kernel updates, and local security policy.

Reliable Penguin response

Using our automation platform, Reliable Penguin has reviewed all servers in our managed fleet for exposure to this vulnerability and has taken appropriate mitigation steps where needed.

At this point, no action is necessary from clients.

If we identify any system-specific concerns that require client involvement, we will contact the affected client directly.

References

• BleepingComputer: New CIFSwitch Linux flaw gives root on multiple distributions
• Technical analysis: CIFSwitch: a non-universal Linux local root vulnerability
• Openwall oss-security disclosure: CIFSwitch Linux kernel/cifs-utils local root via forged CIFS SPNEGO description
• CloudLinux: CIFSwitch Mitigation and Kernel Update