Performing verification for jammy. This will cover both the kernel and the cifs-utils package. both in -proposed.
This is going to be long, as we need to test: * patched kernel, patched cifs-utils * patched kernel, existing cifs-utils * existing kernel, patched cifs-utils I started a fresh jammy VM, with: kernel 5.15.0-140-generic from -updates cifs-utils 2:6.14-1ubuntu0.1 from -updates I then followed the instructions to about step 34. root@jammy-dc:/home/ubuntu# kinit [email protected] Password for [email protected]: Warning: Your password will expire in 16 days on Wed Jun 11 05:39:46 2025 root@jammy-dc:/home/ubuntu# klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: [email protected] Valid starting Expires Service principal 05/25/25 05:44:44 05/25/25 15:44:44 krbtgt/[email protected] renew until 05/26/25 05:44:41 root@jammy-dc:/home/ubuntu# mount -t cifs -o cruid=root,user=root,sec=krb5i,uid=0,gid=0,cred=/tmp/krb5cc_0 //samba-dc.example.com/demo /mnt/testshare1 root@jammy-dc:/home/ubuntu# klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: [email protected] Valid starting Expires Service principal 05/25/25 05:44:44 05/25/25 15:44:44 krbtgt/[email protected] renew until 05/26/25 05:44:41 05/25/25 05:44:56 05/25/25 15:44:44 cifs/samba-dc.example.com@ renew until 05/26/25 05:44:41 Ticket server: cifs/[email protected] # journalctl -b0 kernel: Key type cifs.spnego registered kernel: Key type cifs.idmap registered kernel: CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). T> kernel: CIFS: enabling forceuid mount option implicitly because uid= option is specified kernel: CIFS: enabling forcegid mount option implicitly because gid= option is specified kernel: CIFS: Attempting to mount \\samba-dc.example.com\demo cifs.upcall[1689]: key description: cifs.spnego;0;0;39010000;ver=0x2;host=samba-dc.example.com;ip4=192.168.122.168;sec=krb5;uid=0x0;creduid=0x0> cifs.upcall[1690]: ver=2 cifs.upcall[1690]: host=samba-dc.example.com cifs.upcall[1690]: ip=192.168.122.168 cifs.upcall[1690]: sec=1 cifs.upcall[1690]: uid=0 cifs.upcall[1690]: creduid=0 cifs.upcall[1690]: user=root cifs.upcall[1690]: pid=1664 cifs.upcall[1689]: get_cachename_from_process_env: pid == 0 cifs.upcall[1689]: get_existing_cc: default ccache is FILE:/tmp/krb5cc_0 cifs.upcall[1689]: handle_krb5_mech: getting service ticket for samba-dc.example.com cifs.upcall[1689]: handle_krb5_mech: obtained service ticket cifs.upcall[1689]: Exit status 0 root@jammy-dc:/home/ubuntu# stat /mnt/testshare1 File: /mnt/testshare1 Size: 0 Blocks: 0 IO Block: 1048576 directory Device: 2ch/44d Inode: 261033 Links: 2 Access: (0755/drwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2025-04-30 05:43:19.217555200 +0000 Modify: 2025-04-30 05:42:30.507699600 +0000 Change: 2025-04-30 05:42:30.507699600 +0000 Birth: 2025-04-30 05:42:30.490607200 +0000 # docker run -it -v /mnt/testshare1:/mnt/shared --name cifstest ubuntu:22.04 /bin/bash root@jammy-dc:/home/ubuntu# docker start 407b86c09871 407b86c09871 root@jammy-dc:/home/ubuntu# docker exec -it 407b86c09871 bash root@407b86c09871:/# stat /mnt/shared/ File: /mnt/shared/ Size: 0 Blocks: 0 IO Block: 1048576 directory Device: 2ch/44d Inode: 261033 Links: 2 Access: (0755/drwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2025-04-30 05:43:19.217555200 +0000 Modify: 2025-04-30 05:42:30.507699600 +0000 Change: 2025-04-30 05:42:30.507699600 +0000 Birth: 2025-04-30 05:42:30.490607200 +0000 root@fcec5b069772:/# vim /etc/krb5.conf default_ccache_name = /tmp/krb5cc_00%{uid} Now back on the host: root@jammy-dc:/home/ubuntu# kdestroy -c /tmp/krb5cc_0 root@jammy-dc:/home/ubuntu# ss -K dport 445 Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port Process tcp ESTAB 0 0 192.168.122.168:42936 192.168.122.168:microsoft-ds On the docker container: root@fcec5b069772:/# stat /mnt/shared stat: cannot statx '/mnt/shared': Required key not available On the host: # journalctl -f cifs.upcall[1829]: key description: cifs.spnego;0;0;39010000;ver=0x2;host=samba-dc.example.com;ip4=192.168.122.168;sec=krb5;uid=0x0;creduid=0x0;user=root;pid=0x722 cifs.upcall[1830]: ver=2 cifs.upcall[1830]: host=samba-dc.example.com cifs.upcall[1830]: ip=192.168.122.168 cifs.upcall[1830]: sec=1 cifs.upcall[1830]: uid=0 cifs.upcall[1830]: creduid=0 cifs.upcall[1830]: user=root cifs.upcall[1830]: pid=1826 cifs.upcall[1829]: get_cachename_from_process_env: pid == 0 cifs.upcall[1829]: get_existing_cc: default ccache is FILE:/tmp/krb5cc_000 cifs.upcall[1829]: get_tgt_time: unable to get principal cifs.upcall[1829]: krb5_get_init_creds_keytab: -1765328228 cifs.upcall[1829]: Exit status 1 kernel: CIFS: VFS: Verify user has a krb5 ticket and keyutils is installed kernel: CIFS: VFS: \\samba-dc.example.com Send error in SessSetup = -126 Note the line: get_existing_cc: default ccache is FILE:/tmp/krb5cc_000 In this case, cifs.upcall tried to use the kerberos credential cache from the container namespace, instead of the host namespace where the mount was actually first mounted in. So we can reproduce the issue. Next we will test: * patched kernel, patched cifs-utils ==================================== kernel: 5.15.0-142-generic from -proposed cifs-utils 2:6.14-1ubuntu0.2 from -security-proposed First, we make sure existing behaviour is maintained with the default option: root@jammy-dc:/home/ubuntu# mount -t cifs -o cruid=root,user=root,sec=krb5i,uid=0,gid=0,cred=/tmp/krb5cc_0 //samba-dc.example.com/demo /mnt/testshare1 root@jammy-dc:/home/ubuntu# stat /mnt/testshare1 File: /mnt/testshare1 Size: 0 Blocks: 0 IO Block: 1048576 directory Device: 2dh/45d Inode: 261033 Links: 2 Access: (0755/drwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2025-04-30 05:43:19.217555200 +0000 Modify: 2025-04-30 05:42:30.507699600 +0000 Change: 2025-04-30 05:42:30.507699600 +0000 Birth: 2025-04-30 05:42:30.490607200 +0000 # journalctl -b0 kernel: CIFS: enabling forceuid mount option implicitly because uid= option is specified kernel: CIFS: enabling forcegid mount option implicitly because gid= option is specified kernel: CIFS: Attempting to mount \\samba-dc.example.com\demo cifs.upcall[1686]: key description: cifs.spnego;0;0;39010000;ver=0x2;host=samba-dc.example.com;ip4=192.168.122.168;sec=krb5;uid=0x0;creduid=0x0;user=root;pid=0x692;upcall_target=app cifs.upcall[1687]: ver=2 cifs.upcall[1687]: host=samba-dc.example.com cifs.upcall[1687]: ip=192.168.122.168 cifs.upcall[1687]: sec=1 cifs.upcall[1687]: uid=0 cifs.upcall[1687]: creduid=0 cifs.upcall[1687]: user=root cifs.upcall[1687]: pid=1682 cifs.upcall[1687]: upcall_target=app cifs.upcall[1686]: upcall_target=app, switching namespaces to application thread cifs.upcall[1686]: get_cachename_from_process_env: pid == 0 cifs.upcall[1686]: get_existing_cc: default ccache is FILE:/tmp/krb5cc_0 cifs.upcall[1686]: main: valid service ticket exists in credential cache cifs.upcall[1686]: handle_krb5_mech: getting service ticket for samba-dc.example.com cifs.upcall[1686]: handle_krb5_mech: obtained service ticket cifs.upcall[1686]: Exit status 0 Note, upcall_target=app is enabled by default. In the docker container: root@jammy-dc:/home/ubuntu# docker start 407b86c09871 407b86c09871 root@jammy-dc:/home/ubuntu# docker exec -it 407b86c09871 bash root@407b86c09871:/# stat /mnt/shared File: /mnt/shared Size: 0 Blocks: 0 IO Block: 1048576 directory Device: 2dh/45d Inode: 261033 Links: 2 Access: (0755/drwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2025-04-30 05:43:19.217555200 +0000 Modify: 2025-04-30 05:42:30.507699600 +0000 Change: 2025-04-30 05:42:30.507699600 +0000 Birth: 2025-04-30 05:42:30.490607200 +0000 On the host: root@jammy-dc:/home/ubuntu# kdestroy -c /tmp/krb5cc_0 root@jammy-dc:/home/ubuntu# ss -K dport 445 Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port Process tcp ESTAB 0 0 192.168.122.168:42342 192.168.122.168:microsoft-ds On the container: root@407b86c09871:/# stat /mnt/shared stat: cannot statx '/mnt/shared': Required key not available On the host: # journalctl -f cifs.upcall[1814]: key description: cifs.spnego;0;0;39010000;ver=0x2;host=samba-dc.example.com;ip4=192.168.122.168;sec=krb5;uid=0x0;creduid=0x0;user=root;pid=0x715;upcall_target=app cifs.upcall[1815]: ver=2 cifs.upcall[1815]: host=samba-dc.example.com cifs.upcall[1815]: ip=192.168.122.168 cifs.upcall[1815]: sec=1 cifs.upcall[1815]: uid=0 cifs.upcall[1815]: creduid=0 cifs.upcall[1815]: user=root cifs.upcall[1815]: pid=1813 cifs.upcall[1815]: upcall_target=app cifs.upcall[1814]: upcall_target=app, switching namespaces to application thread cifs.upcall[1814]: get_cachename_from_process_env: pid == 0 cifs.upcall[1814]: get_existing_cc: default ccache is FILE:/tmp/krb5cc_000 cifs.upcall[1814]: check_service_ticket_exists: unable to get client principal from cache: No credentials cache found (filename: /tmp/krb5cc_000) cifs.upcall[1814]: get_tgt_time: unable to get principal cifs.upcall[1814]: main: valid TGT is not present in credential cache cifs.upcall[1814]: krb5_get_init_creds_keytab: -1765328228 cifs.upcall[1814]: Exit status 1 kernel: CIFS: VFS: Verify user has a krb5 ticket and keyutils is installed kernel: CIFS: VFS: \\samba-dc.example.com Send error in SessSetup = -126 We still have existing behaviour by default: cifs.upcall[1814]: get_existing_cc: default ccache is FILE:/tmp/krb5cc_000 which means we will not cause any regressions. Next, we will use the new mount option, "upcall_target=mount": # mount -t cifs -o cruid=root,user=root,sec=krb5i,uid=0,gid=0,cred=/tmp/krb5cc_0,upcall_target=mount //samba-dc.example.com/demo /mnt/testshare1 # journalctl -b0 kernel: CIFS: enabling forceuid mount option implicitly because uid= option is specified kernel: CIFS: enabling forcegid mount option implicitly because gid= option is specified kernel: CIFS: Attempting to mount \\samba-dc.example.com\demo cifs.upcall[1877]: key description: cifs.spnego;0;0;39010000;ver=0x2;host=samba-dc.example.com;ip4=192.168.122.168;sec=krb5;uid=0x0;creduid=0x0> cifs.upcall[1878]: ver=2 cifs.upcall[1878]: host=samba-dc.example.com cifs.upcall[1878]: ip=192.168.122.168 cifs.upcall[1878]: sec=1 cifs.upcall[1878]: uid=0 cifs.upcall[1878]: creduid=0 cifs.upcall[1878]: user=root cifs.upcall[1878]: pid=1873 cifs.upcall[1878]: upcall_target=mount cifs.upcall[1877]: upcall_target=mount, not switching namespaces to application thread cifs.upcall[1877]: get_cachename_from_process_env: pid == 0 cifs.upcall[1877]: get_existing_cc: default ccache is FILE:/tmp/krb5cc_0 cifs.upcall[1877]: main: valid service ticket exists in credential cache cifs.upcall[1877]: handle_krb5_mech: getting service ticket for samba-dc.example.com cifs.upcall[1877]: handle_krb5_mech: obtained service ticket cifs.upcall[1877]: Exit status 0 Now we have upcall_target=mount set. In the container: root@jammy-dc:/home/ubuntu# docker start 407b86c09871 407b86c09871 root@jammy-dc:/home/ubuntu# docker exec -it 407b86c09871 bash root@407b86c09871:/# stat /mnt/shared File: /mnt/shared Size: 0 Blocks: 0 IO Block: 1048576 directory Device: 2dh/45d Inode: 261033 Links: 2 Access: (0755/drwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2025-04-30 05:43:19.217555200 +0000 Modify: 2025-04-30 05:42:30.507699600 +0000 Change: 2025-04-30 05:42:30.507699600 +0000 Birth: 2025-04-30 05:42:30.490607200 +0000 On the host: root@jammy-dc:/home/ubuntu# kdestroy -c /tmp/krb5cc_0 root@jammy-dc:/home/ubuntu# ss -K dport 445 Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port Process tcp ESTAB 0 0 192.168.122.168:49416 192.168.122.168:microsoft-ds On the container: root@685c7e420afc:/# stat /mnt/shared stat: cannot statx '/mnt/shared': Required key not available On the host: # journalctl -f cifs.upcall[2001]: key description: cifs.spnego;0;0;39010000;ver=0x2;host=samba-dc.example.com;ip4=192.168.122.168;sec=krb5;uid=0x0;creduid=0x0;user=root;pid=0x7d0;upcall_target=mount cifs.upcall[2002]: ver=2 cifs.upcall[2002]: host=samba-dc.example.com cifs.upcall[2002]: ip=192.168.122.168 cifs.upcall[2002]: sec=1 cifs.upcall[2002]: uid=0 cifs.upcall[2002]: creduid=0 cifs.upcall[2002]: user=root cifs.upcall[2002]: pid=2000 cifs.upcall[2002]: upcall_target=mount cifs.upcall[2001]: upcall_target=mount, not switching namespaces to application thread cifs.upcall[2001]: get_cachename_from_process_env: pid == 0 cifs.upcall[2001]: get_existing_cc: default ccache is FILE:/tmp/krb5cc_0 cifs.upcall[2001]: check_service_ticket_exists: unable to get client principal from cache: No credentials cache found (filename: /tmp/krb5cc_0) cifs.upcall[2001]: get_tgt_time: unable to get principal cifs.upcall[2001]: main: valid TGT is not present in credential cache cifs.upcall[2001]: krb5_get_init_creds_keytab: -1765328378 cifs.upcall[2001]: Exit status 1 kernel: CIFS: VFS: Verify user has a krb5 ticket and keyutils is installed kernel: CIFS: VFS: \\samba-dc.example.com Send error in SessSetup = -126 Now that "mount" is used, we correctly only use the credential cache from the host namespace, which is FILE:/tmp/krb5cc_0, and we don't leak any data between the container or the host, fixing the security issue. Next we will test: * patched kernel, existing cifs-utils ===================================== kernel: 5.15.0-142-generic from -proposed cifs-utils: 2:6.14-1ubuntu0.1 from -updates If we were to manually specify upcall_target=app on the mount command line: root@samba-dc:/home/ubuntu# mount -t cifs -o cruid=root,user=root,sec=krb5i,uid=0,gid=0,cred=/tmp/krb5cc_0,upcall_target=app //samba-dc.example.com/demo /mnt/testshare1 # journalctl -f kernel: CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). T> kernel: CIFS: enabling forceuid mount option implicitly because uid= option is specified kernel: CIFS: enabling forcegid mount option implicitly because gid= option is specified kernel: CIFS: Attempting to mount \\samba-dc.example.com\demo cifs.upcall[1456]: key description: cifs.spnego;0;0;39010000;ver=0x2;host=samba-dc.example.com;ip4=192.168.122.168;sec=krb5;uid=0x0;creduid=0x0;user=root;pid=0x59a;upcall_target=app cifs.upcall[1457]: ver=2 cifs.upcall[1457]: host=samba-dc.example.com cifs.upcall[1457]: ip=192.168.122.168 cifs.upcall[1457]: sec=1 cifs.upcall[1457]: uid=0 cifs.upcall[1457]: creduid=0 cifs.upcall[1457]: user=root cifs.upcall[1457]: pid=1434 cifs.upcall[1456]: get_cachename_from_process_env: pid == 0 cifs.upcall[1456]: get_existing_cc: default ccache is FILE:/tmp/krb5cc_0 cifs.upcall[1456]: handle_krb5_mech: getting service ticket for samba-dc.example.com cifs.upcall[1456]: handle_krb5_mech: obtained service ticket cifs.upcall[1456]: Exit status 0 The mount continues successfully. The existing cifs-utils does not complain about it. Test with no "upcall_target". e.g.: # mount -t cifs -o cruid=root,user=root,sec=krb5i,uid=0,gid=0,cred=/tmp/krb5cc_0 //samba-dc.example.com/demo /mnt/testshare1 # journalctl -b0 kernel: CIFS: enabling forceuid mount option implicitly because uid= option is specified kernel: CIFS: enabling forcegid mount option implicitly because gid= option is specified kernel: CIFS: Attempting to mount \\samba-dc.example.com\demo cifs.upcall[1467]: key description: cifs.spnego;0;0;39010000;ver=0x2;host=samba-dc.example.com;ip4=192.168.122.168;sec=krb5;uid=0x0;creduid=0x0;user=root;pid=0x5b7;upcall_target=app cifs.upcall[1468]: ver=2 cifs.upcall[1468]: host=samba-dc.example.com cifs.upcall[1468]: ip=192.168.122.168 cifs.upcall[1468]: sec=1 cifs.upcall[1468]: uid=0 cifs.upcall[1468]: creduid=0 cifs.upcall[1468]: user=root cifs.upcall[1468]: pid=1463 cifs.upcall[1467]: get_cachename_from_process_env: pid == 0 cifs.upcall[1467]: get_existing_cc: default ccache is FILE:/tmp/krb5cc_0 cifs.upcall[1467]: handle_krb5_mech: getting service ticket for samba-dc.example.com cifs.upcall[1467]: handle_krb5_mech: obtained service ticket cifs.upcall[1467]: Exit status 0 Note, that we still see "upcall_target=app" appended to key description even though this is with existing cifs-utils. The mount still succeeds as normal. Next we will test: * existing kernel, patched cifs-utils ===================================== kernel 5.15.0-140-generic from -updates cifs-utils 2:6.14-1ubuntu0.2 from -security-proposed If we were to manually specify upcall_target=app on the mount command line: # mount -t cifs -o cruid=root,user=root,sec=krb5i,uid=0,gid=0,cred=/tmp/krb5cc_0,upcall_target=app //samba-dc.example.com/demo /mnt/testshare1 mount error(22): Invalid argument Refer to the mount.cifs(8) manual page (e.g. man mount.cifs) and kernel log messages (dmesg) # journalctl -b0 jammy-dc kernel: cifs: Unknown parameter 'upcall_target' cifs-utils accepts it, but the kernel does not, and fails with an unknown parameter. This is okay, because the existing kernel does not have support for the new parameter, and users would be manually be adding it to their mount parameters anyway. If they went to this effort, they would notice their kernel is out of date and would upgrade their kernel to get support. Testing with no "upcall_target": # mount -t cifs -o cruid=root,user=root,sec=krb5i,uid=0,gid=0,cred=/tmp/krb5cc_0 //samba-dc.example.com/demo /mnt/testshare1 # mount -l //samba-dc.example.com/demo on /mnt/testshare1 type cifs (rw,relatime,vers=3.1.1,sec=krb5i,cruid=0,cache=strict,username=root,uid=0,forceuid,gid=0,forcegid,addr=192.168.122.168,file_mode=0755,dir_mode=0755,soft,nounix,serverino,mapposix,rsize=4194304,wsize=4194304,bsize=1048576,echo_interval=60,actimeo=1,closetimeo=1,user=root) # journalctl -f kernel: CIFS: enabling forceuid mount option implicitly because uid= option is specified kernel: CIFS: enabling forcegid mount option implicitly because gid= option is specified kernel: CIFS: Attempting to mount \\samba-dc.example.com\demo cifs.upcall[2137]: key description: cifs.spnego;0;0;39010000;ver=0x2;host=samba-dc.example.com;ip4=192.168.122.168;sec=krb5;uid=0x0;creduid=0x0;user=root;pid=0x853 cifs.upcall[2138]: ver=2 cifs.upcall[2138]: host=samba-dc.example.com cifs.upcall[2138]: ip=192.168.122.168 cifs.upcall[2138]: sec=1 cifs.upcall[2138]: uid=0 cifs.upcall[2138]: creduid=0 cifs.upcall[2138]: user=root cifs.upcall[2138]: pid=2131 cifs.upcall[2137]: upcall_target=app, switching namespaces to application thread cifs.upcall[2137]: get_cachename_from_process_env: pid == 0 cifs.upcall[2137]: get_existing_cc: default ccache is FILE:/tmp/krb5cc_0 cifs.upcall[2137]: main: valid service ticket exists in credential cache cifs.upcall[2137]: handle_krb5_mech: getting service ticket for samba-dc.example.com cifs.upcall[2137]: handle_krb5_mech: obtained service ticket cifs.upcall[2137]: Exit status 0 Mounting shares without any additional mount parameters still works correctly. cifs-utils does not append upcall_target=app to the mount command line, so existing kernel continues to work correctly. Note, it does now mention: cifs.upcall[2137]: upcall_target=app, switching namespaces to application thread to say that it uses the current process namespace, which is the same as existing behaviour. We have covered all situations of the testing matrix. Both the kernel in -proposed and cifs-utils in -security-proposed fix the issue, and don't cause any issues being installed independently with or without each other. Happy to mark verified for jammy. ** Tags removed: verification-needed-jammy-linux ** Tags added: verification-done-jammy verification-done-jammy-linux -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2099914 Title: CVE-2025-2312 cifs.upcall could access incorrect kerberos credentials cache To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/cifs-utils/+bug/2099914/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
