KaraZajac
ada56b0db3
CIFSwitch is the newest kernel-7-era LPE not already in the corpus: a
~19-year-old logic flaw in fs/smb/client/cifs_spnego.c where the
cifs.spnego request-key type accepts key descriptions created by
userspace (add_key(2)/request_key(2)) without verifying the request came
from the in-kernel CIFS client. The description's authority-bearing
fields (pid/uid/creduid/upcall_target) are trusted by the root cifs.upcall
helper; with user+mount namespace tricks an unprivileged user coerces
cifs.upcall into loading an attacker NSS module as root. Fixed upstream by
3da1fdf4efbc (merged 7.1-rc5); CWE-20; not in CISA KEV.
Takes the corpus to 42 modules / 37 CVEs.
🟡 honest port — full chain not VM-verified. detect() gates on the kernel
version (Debian backports 5.10.257/6.1.174/6.12.90/7.0.10) AND on the
cifs userspace path (cifs.upcall / cifs.spnego request-key rule), so a
vulnerable kernel without cifs-utils is PRECOND_FAIL not a false positive
(override via SKELETONKEY_CIFS_ASSUME_PRESENT=1/0). exploit() fires only
the non-destructive add_key(2) cifs.spnego probe (no upcall, loads
nothing, revoked immediately) and returns EXPLOIT_FAIL without a euid-0
witness — the namespace+NSS root-pop is not bundled until VM-verified.
--mitigate blocklists the cifs module; --cleanup reverts.
Wired everywhere: registry, Makefile, safety rank (86), 6 detect() test
rows (env-driven precondition override), CVE_METADATA.json + cve_metadata.c
+ KEV_CROSSREF.md (sorted insert, CWE-20/T1068/not-KEV), README + CVES.md
+ website counts (42/37) and a yellow module pill, RELEASE_NOTES v0.9.10,
verify-vm target (sweep pending). Credit: Asim Manizada. Version 0.9.10.
2.5 KiB
cifswitch — CVE-2026-46243 ("CIFSwitch")
The kernel's cifs.spnego request-key type trusts userspace-forged
authority fields, letting the root cifs.upcall helper be coerced into
loading an attacker NSS module as root.
The bug
fs/smb/client/cifs_spnego.c registers the cifs.spnego key type so the
kernel CIFS client can ask the root-privileged cifs.upcall helper to
perform a SPNEGO/Kerberos exchange. The key description carries
authority-bearing fields — pid, uid, creduid, upcall_target —
that cifs.upcall reads as trusted, kernel-originating inputs.
The flaw: the kernel never verified the request actually came from the
in-kernel CIFS client. Userspace can create keys of this type directly
through add_key(2) / request_key(2), supplying all those fields. By
forging a description and manipulating user + mount namespaces, an
unprivileged user makes cifs.upcall trust attacker-controlled state and
load a malicious NSS shared library as root → root code execution.
Affected range
| Flaw age | ~19 years (predates key-type origin checks) |
| Fixed upstream | commit 3da1fdf4efbc, merged 7.1-rc5 |
| Debian backports | 5.10.257 · 6.1.174 · 6.12.90 · 7.0.10 |
| NVD class | CWE-20 (Improper Input Validation) |
| CISA KEV | no (as of disclosure) |
Branches Debian does not ship (5.15 / 6.6 / 6.8 / 6.11 …) are reported on the version-only verdict; confirm empirically.
Trigger / detection
detect() returns OK for patched kernels, PRECOND_FAIL for a
vulnerable kernel where cifs.upcall / the cifs.spnego request-key rule
isn't installed (cifs-utils absent → unreachable), and VULNERABLE when
both the version and the userspace path line up. The precondition probe
can be overridden with SKELETONKEY_CIFS_ASSUME_PRESENT=1 (force present)
or 0 (force absent).
exploit() fires the non-destructive primitive: add_key(2) of a
forged-but-benign cifs.spnego key (no upcall, loads nothing), revoked
immediately. A clean accept is the witness that userspace can forge the
authority-bearing key type. The full root-pop (namespace switch +
malicious NSS load) is not bundled until VM-verified — honest
EXPLOIT_FAIL without a euid-0 witness.
Fix / mitigation
Upgrade the kernel. As a runtime stopgap, blocklist the cifs module —
--mitigate writes /etc/modprobe.d/skeletonkey-disable-cifs.conf
(needs root) and --cleanup removes it. Already-loaded cifs persists
until unmount + rmmod cifs or reboot.
Credit
Asim Manizada (2026-05-28). See NOTICE.md.