Linux kernel CIFSwitch flaw lets local users gain root

A significant vulnerability in the Linux kernel, present for nearly two decades, allows local attackers to gain full administrative control over affected systems. The flaw, named CIFSwitch, impacts a range of popular distributions and stems from a missing security check in a core networking component.

The vulnerability exists at the intersection of the kernel's CIFS client—which handles a Windows-style network file-sharing protocol—and a userspace helper program called cifs.upcall, part of the cifsutils package. When a system mounts a network share using Kerberos authentication, the kernel requests a specific authentication key. A root-privileged helper then fetches the required credentials. Security engineer Asim Manizada, who discovered the issue, explained that the kernel fails to verify that these key requests originate from its own CIFS subsystem. This allows an unprivileged user to forge a request with manipulated data.

By crafting a malicious key request, an attacker can control fields that instruct the cifs.upcall helper to switch into a namespace they control, all while the helper is still running with root privileges. Before dropping these elevated permissions, the...