💩 CIFSwitch: a non-universal Linux local root vulnerability


new LPE like root issue just dropped.
CIFSwitch is actually a pretty beautiful chain:
1️⃣ unprivileged user can make cifs.spnego requests
2️⃣ kernel happily accepts them
3️⃣ /usr/sbin/cifs.upcall gets launched as root
4️⃣ attacker controls pid + namespace switching
5️⃣ root process loads attacker-controlled NSS module
6️⃣ gg -> root

the funniest part is that:
- no memory corruption
- no buffer overflow

mostly trust / logic issues between kernel <-> userspace.

affected since ~2007.
many distros exploitable out of the box depending on SELinux/AppArmor policies.

mitigations:
- patch kernel
- remove cifs-utils if unused
- disable unprivileged namespaces
- block cifs module loading

🤔also interesting: author mentions using LLM-assisted graph reasoning to find multi-step vuln chains instead of simple grep/fuzzing.
this part is probably more important long-term than the vuln itself.

https://heyitsas.im/posts/cifswitch/

#security #linux