KaraZajac
ada56b0db3
release / build (arm64) (push) Waiting to run
release / build (x86_64) (push) Waiting to run
release / build (x86_64-static / musl) (push) Waiting to run
release / build (arm64-static / musl) (push) Waiting to run
release / release (push) Blocked by required conditions
CIFSwitch is the newest kernel-7-era LPE not already in the corpus: a
~19-year-old logic flaw in fs/smb/client/cifs_spnego.c where the
cifs.spnego request-key type accepts key descriptions created by
userspace (add_key(2)/request_key(2)) without verifying the request came
from the in-kernel CIFS client. The description's authority-bearing
fields (pid/uid/creduid/upcall_target) are trusted by the root cifs.upcall
helper; with user+mount namespace tricks an unprivileged user coerces
cifs.upcall into loading an attacker NSS module as root. Fixed upstream by
3da1fdf4efbc (merged 7.1-rc5); CWE-20; not in CISA KEV.
Takes the corpus to 42 modules / 37 CVEs.
🟡 honest port — full chain not VM-verified. detect() gates on the kernel
version (Debian backports 5.10.257/6.1.174/6.12.90/7.0.10) AND on the
cifs userspace path (cifs.upcall / cifs.spnego request-key rule), so a
vulnerable kernel without cifs-utils is PRECOND_FAIL not a false positive
(override via SKELETONKEY_CIFS_ASSUME_PRESENT=1/0). exploit() fires only
the non-destructive add_key(2) cifs.spnego probe (no upcall, loads
nothing, revoked immediately) and returns EXPLOIT_FAIL without a euid-0
witness — the namespace+NSS root-pop is not bundled until VM-verified.
--mitigate blocklists the cifs module; --cleanup reverts.
Wired everywhere: registry, Makefile, safety rank (86), 6 detect() test
rows (env-driven precondition override), CVE_METADATA.json + cve_metadata.c
+ KEV_CROSSREF.md (sorted insert, CWE-20/T1068/not-KEV), README + CVES.md
+ website counts (42/37) and a yellow module pill, RELEASE_NOTES v0.9.10,
verify-vm target (sweep pending). Credit: Asim Manizada. Version 0.9.10.
70 lines
3.5 KiB
Markdown
70 lines
3.5 KiB
Markdown
# NOTICE — cifswitch (CVE-2026-46243, "CIFSwitch")
|
||
|
||
## Vulnerability
|
||
|
||
**CVE-2026-46243 "CIFSwitch"** — the Linux kernel's `cifs.spnego`
|
||
request-key type (`fs/smb/client/cifs_spnego.c`) accepts key descriptions
|
||
created by **userspace** (via `add_key(2)` / `request_key(2)`) without
|
||
verifying that the request originated from the in-kernel CIFS client. The
|
||
key description carries authority-bearing fields — `pid`, `uid`,
|
||
`creduid`, `upcall_target` — that the root-privileged `cifs.upcall`
|
||
helper treats as trusted, kernel-originating inputs. An unprivileged
|
||
local user forges such a description and, combined with user + mount
|
||
namespace manipulation, coerces `cifs.upcall` into loading an
|
||
attacker-controlled NSS shared library as root → local privilege
|
||
escalation to root.
|
||
|
||
It is a **~19-year-old** logic flaw — the cifs spnego upcall predates the
|
||
key-type origin checks added to the keyrings subsystem later. NVD class:
|
||
**CWE-20** (Improper Input Validation). Not in CISA KEV (as of disclosure).
|
||
|
||
**Preconditions:** the `cifs` kernel module available, `cifs-utils`
|
||
installed (so `cifs.upcall` is present), and the `cifs.spnego`
|
||
request-key rule active. Default-vulnerable distributions reported
|
||
include Linux Mint, CentOS Stream 9, Rocky Linux 9, AlmaLinux 9, Kali
|
||
Linux, SLES 15 SP7, and Red Hat Enterprise Linux 6–10.
|
||
|
||
## Research credit
|
||
|
||
Discovered, named, and disclosed by **Asim Manizada** on **2026-05-28**,
|
||
with a working proof-of-concept published the same day.
|
||
|
||
- Red Hat advisory (RHSB-2026-005):
|
||
<https://access.redhat.com/security/vulnerabilities/RHSB-2026-005>
|
||
- BleepingComputer write-up:
|
||
<https://www.bleepingcomputer.com/news/security/new-cifswitch-linux-flaw-gives-root-on-multiple-distributions/>
|
||
- Upstream fix: commit `3da1fdf4efbc490041eb4f836bf596201203f8f2`
|
||
("smb: client: reject userspace cifs.spnego descriptions"), merged
|
||
7.1-rc5.
|
||
- Debian-tracked stable backports: 5.10.257 (bullseye) / 6.1.174
|
||
(bookworm) / 6.12.90 (trixie) / 7.0.10 (forky, sid).
|
||
|
||
All research credit for finding and analysing this bug belongs to Asim
|
||
Manizada. SKELETONKEY is the bundling and bookkeeping layer only.
|
||
|
||
## SKELETONKEY role
|
||
|
||
🟡 **Primitive / ported-from-disclosure — not yet VM-verified.**
|
||
`detect()` gates on the kernel version (the Debian backport thresholds
|
||
above) **and** the presence of the vulnerable userspace path
|
||
(`cifs.upcall` / the `cifs.spnego` request-key rule) — a vulnerable
|
||
kernel without `cifs-utils` is reported `PRECOND_FAIL`, not `VULNERABLE`.
|
||
Override the probe with `SKELETONKEY_CIFS_ASSUME_PRESENT=1` (or `0`).
|
||
|
||
`exploit()` fires only the reachable, **non-destructive** part of the
|
||
primitive: it attempts to register a forged-but-benign `cifs.spnego` key
|
||
as the unprivileged user via `add_key(2)` — which instantiates the key
|
||
directly and does **not** invoke `cifs.upcall`, so it loads nothing and
|
||
spawns no privileged helper — and revokes the key immediately. A clean
|
||
accept is the empirical witness that the missing-origin-validation flaw
|
||
is present. It then **stops**: the namespace-switch + malicious-NSS-load
|
||
chain that actually lands a root shell is target/config-specific and is
|
||
**not** bundled until it can be verified end-to-end against a real
|
||
vulnerable VM, in keeping with the project's no-fabrication rule.
|
||
`exploit()` returns `EXPLOIT_FAIL` unless it can witness euid 0.
|
||
|
||
`--mitigate` writes `/etc/modprobe.d/skeletonkey-disable-cifs.conf`
|
||
(blocklists the `cifs` module — the vendor-recommended runtime
|
||
mitigation); `--cleanup` removes it. Architecture-agnostic — keyring and
|
||
namespace logic, no shellcode.
|