KaraZajac
ada56b0db3
CIFSwitch is the newest kernel-7-era LPE not already in the corpus: a
~19-year-old logic flaw in fs/smb/client/cifs_spnego.c where the
cifs.spnego request-key type accepts key descriptions created by
userspace (add_key(2)/request_key(2)) without verifying the request came
from the in-kernel CIFS client. The description's authority-bearing
fields (pid/uid/creduid/upcall_target) are trusted by the root cifs.upcall
helper; with user+mount namespace tricks an unprivileged user coerces
cifs.upcall into loading an attacker NSS module as root. Fixed upstream by
3da1fdf4efbc (merged 7.1-rc5); CWE-20; not in CISA KEV.
Takes the corpus to 42 modules / 37 CVEs.
🟡 honest port — full chain not VM-verified. detect() gates on the kernel
version (Debian backports 5.10.257/6.1.174/6.12.90/7.0.10) AND on the
cifs userspace path (cifs.upcall / cifs.spnego request-key rule), so a
vulnerable kernel without cifs-utils is PRECOND_FAIL not a false positive
(override via SKELETONKEY_CIFS_ASSUME_PRESENT=1/0). exploit() fires only
the non-destructive add_key(2) cifs.spnego probe (no upcall, loads
nothing, revoked immediately) and returns EXPLOIT_FAIL without a euid-0
witness — the namespace+NSS root-pop is not bundled until VM-verified.
--mitigate blocklists the cifs module; --cleanup reverts.
Wired everywhere: registry, Makefile, safety rank (86), 6 detect() test
rows (env-driven precondition override), CVE_METADATA.json + cve_metadata.c
+ KEV_CROSSREF.md (sorted insert, CWE-20/T1068/not-KEV), README + CVES.md
+ website counts (42/37) and a yellow module pill, RELEASE_NOTES v0.9.10,
verify-vm target (sweep pending). Credit: Asim Manizada. Version 0.9.10.
3.5 KiB
NOTICE — cifswitch (CVE-2026-46243, "CIFSwitch")
Vulnerability
CVE-2026-46243 "CIFSwitch" — the Linux kernel's cifs.spnego
request-key type (fs/smb/client/cifs_spnego.c) accepts key descriptions
created by userspace (via add_key(2) / request_key(2)) without
verifying that the request originated from the in-kernel CIFS client. The
key description carries authority-bearing fields — pid, uid,
creduid, upcall_target — that the root-privileged cifs.upcall
helper treats as trusted, kernel-originating inputs. An unprivileged
local user forges such a description and, combined with user + mount
namespace manipulation, coerces cifs.upcall into loading an
attacker-controlled NSS shared library as root → local privilege
escalation to root.
It is a ~19-year-old logic flaw — the cifs spnego upcall predates the key-type origin checks added to the keyrings subsystem later. NVD class: CWE-20 (Improper Input Validation). Not in CISA KEV (as of disclosure).
Preconditions: the cifs kernel module available, cifs-utils
installed (so cifs.upcall is present), and the cifs.spnego
request-key rule active. Default-vulnerable distributions reported
include Linux Mint, CentOS Stream 9, Rocky Linux 9, AlmaLinux 9, Kali
Linux, SLES 15 SP7, and Red Hat Enterprise Linux 6–10.
Research credit
Discovered, named, and disclosed by Asim Manizada on 2026-05-28, with a working proof-of-concept published the same day.
- Red Hat advisory (RHSB-2026-005): https://access.redhat.com/security/vulnerabilities/RHSB-2026-005
- BleepingComputer write-up: https://www.bleepingcomputer.com/news/security/new-cifswitch-linux-flaw-gives-root-on-multiple-distributions/
- Upstream fix: commit
3da1fdf4efbc490041eb4f836bf596201203f8f2("smb: client: reject userspace cifs.spnego descriptions"), merged 7.1-rc5. - Debian-tracked stable backports: 5.10.257 (bullseye) / 6.1.174 (bookworm) / 6.12.90 (trixie) / 7.0.10 (forky, sid).
All research credit for finding and analysing this bug belongs to Asim Manizada. SKELETONKEY is the bundling and bookkeeping layer only.
SKELETONKEY role
🟡 Primitive / ported-from-disclosure — not yet VM-verified.
detect() gates on the kernel version (the Debian backport thresholds
above) and the presence of the vulnerable userspace path
(cifs.upcall / the cifs.spnego request-key rule) — a vulnerable
kernel without cifs-utils is reported PRECOND_FAIL, not VULNERABLE.
Override the probe with SKELETONKEY_CIFS_ASSUME_PRESENT=1 (or 0).
exploit() fires only the reachable, non-destructive part of the
primitive: it attempts to register a forged-but-benign cifs.spnego key
as the unprivileged user via add_key(2) — which instantiates the key
directly and does not invoke cifs.upcall, so it loads nothing and
spawns no privileged helper — and revokes the key immediately. A clean
accept is the empirical witness that the missing-origin-validation flaw
is present. It then stops: the namespace-switch + malicious-NSS-load
chain that actually lands a root shell is target/config-specific and is
not bundled until it can be verified end-to-end against a real
vulnerable VM, in keeping with the project's no-fabrication rule.
exploit() returns EXPLOIT_FAIL unless it can witness euid 0.
--mitigate writes /etc/modprobe.d/skeletonkey-disable-cifs.conf
(blocklists the cifs module — the vendor-recommended runtime
mitigation); --cleanup removes it. Architecture-agnostic — keyring and
namespace logic, no shellcode.