Performing verification for focal. This will cover both the kernel and the cifs-utils package. both in -proposed.
This is going to be long, as we need to test: * patched kernel, patched cifs-utils * patched kernel, existing cifs-utils * existing kernel, patched cifs-utils I started a fresh focal VM, with: kernel 5.4.0-216-generic from -updates cifs-utils 2:6.9-1ubuntu0.2 from -updates I then followed the instructions to about step 34. root@focal-dc:/home/ubuntu# kinit [email protected] Password for [email protected]: Warning: Your password will expire in 16 days on Wed Jun 11 06:13:06 2025 root@focal-dc:/home/ubuntu# klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: [email protected] Valid starting Expires Service principal 05/25/25 06:26:20 05/25/25 16:26:20 krbtgt/[email protected] renew until 05/26/25 06:26:17 root@focal-dc:/home/ubuntu# mount -t cifs -o cruid=root,user=root,sec=krb5i,uid=0,gid=0,cred=/tmp/krb5cc_0 //samba-dc.example.com/demo /mnt/testshare1 root@focal-dc:/home/ubuntu# klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: [email protected] Valid starting Expires Service principal 05/25/25 06:26:20 05/25/25 16:26:20 krbtgt/[email protected] renew until 05/26/25 06:26:17 05/25/25 06:26:31 05/25/25 16:26:20 cifs/samba-dc.example.com@ renew until 05/26/25 06:26:17 05/25/25 06:26:31 05/25/25 16:26:20 cifs/[email protected] renew until 05/26/25 06:26:17 # journalctl -b0 kernel: Key type cifs.spnego registered kernel: Key type cifs.idmap registered kernel: CIFS: Attempting to mount //samba-dc.example.com/demo kernel: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3), from CIFS (SMB1). To use the > cifs.upcall[2085]: key description: cifs.spnego;0;0;39010000;ver=0x2;host=samba-dc.example.com;ip4=192.168.122.27;sec=krb5;uid=0x0;creduid=0x0;user=root;pid=0x80f cifs.upcall[2086]: ver=2 cifs.upcall[2086]: host=samba-dc.example.com cifs.upcall[2086]: ip=192.168.122.27 cifs.upcall[2086]: sec=1 cifs.upcall[2086]: uid=0 cifs.upcall[2086]: creduid=0 cifs.upcall[2086]: user=root cifs.upcall[2086]: pid=2063 cifs.upcall[2085]: get_cachename_from_process_env: pid == 0 cifs.upcall[2085]: get_existing_cc: default ccache is FILE:/tmp/krb5cc_0 cifs.upcall[2085]: handle_krb5_mech: getting service ticket for samba-dc.example.com cifs.upcall[2085]: handle_krb5_mech: obtained service ticket cifs.upcall[2085]: Exit status 0 root@focal-dc:/home/ubuntu# stat /mnt/testshare1 File: /mnt/testshare1 Size: 0 Blocks: 0 IO Block: 1048576 directory Device: 35h/53d Inode: 260995 Links: 2 Access: (0755/drwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2025-04-30 06:16:07.320000000 +0000 Modify: 2025-04-30 06:16:07.320000000 +0000 Change: 2025-04-30 06:16:07.320000000 +0000 Birth: - # docker run -it -v /mnt/testshare1:/mnt/shared --name cifstest ubuntu:20.04 /bin/bash root@focal-dc:/home/ubuntu# docker start 2f1a7761412a 2f1a7761412a root@focal-dc:/home/ubuntu# docker exec -it 2f1a7761412a bash root@2f1a7761412a:/# stat /mnt/shared File: /mnt/shared Size: 0 Blocks: 0 IO Block: 1048576 directory Device: 35h/53d Inode: 260995 Links: 2 Access: (0755/drwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2025-04-30 18:16:07.320000000 +1200 Modify: 2025-04-30 18:16:07.320000000 +1200 Change: 2025-04-30 18:16:07.320000000 +1200 Birth: - root@fcec5b069772:/# vim /etc/krb5.conf default_ccache_name = /tmp/krb5cc_00%{uid} Now back on the host: root@focal-dc:/home/ubuntu# kdestroy -c /tmp/krb5cc_0 root@focal-dc:/home/ubuntu# ss -K dport 445 Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port Process tcp ESTAB 0 0 192.168.122.27:36352 192.168.122.27:microsoft-ds On the docker container: root@fcec5b069772:/# stat /mnt/shared stat: cannot statx '/mnt/shared': Required key not available On the host: # journalctl -f cifs.upcall[2305]: key description: cifs.spnego;0;0;39010000;ver=0x2;host=samba-dc.example.com;ip4=192.168.122.27;sec=krb5;uid=0x0;creduid=0x0;user=root;pid=0x8ff cifs.upcall[2306]: ver=2 cifs.upcall[2306]: host=samba-dc.example.com cifs.upcall[2306]: ip=192.168.122.27 cifs.upcall[2306]: sec=1 cifs.upcall[2306]: uid=0 cifs.upcall[2306]: creduid=0 cifs.upcall[2306]: user=root cifs.upcall[2306]: pid=2303 cifs.upcall[2305]: get_cachename_from_process_env: pid == 0 cifs.upcall[2305]: get_existing_cc: default ccache is FILE:/tmp/krb5cc_000 cifs.upcall[2305]: get_tgt_time: unable to get principal cifs.upcall[2305]: krb5_get_init_creds_keytab: -1765328228 cifs.upcall[2305]: Exit status 1 kernel: CIFS VFS: Verify user has a krb5 ticket and keyutils is installed kernel: CIFS VFS: \\samba-dc.example.com Send error in SessSetup = -126 Note the line: get_existing_cc: default ccache is FILE:/tmp/krb5cc_000 In this case, cifs.upcall tried to use the kerberos credential cache from the container namespace, instead of the host namespace where the mount was actually first mounted in. So we can reproduce the issue. Next we will test: * patched kernel, patched cifs-utils ==================================== kernel: 5.4.0-218-generic from -proposed cifs-utils 2:6.9-1ubuntu0.3 from -security-proposed First, we make sure existing behaviour is maintained with the default option: root@focal-dc:/home/ubuntu# mount -t cifs -o cruid=root,user=root,sec=krb5i,uid=0,gid=0,cred=/tmp/krb5cc_0 //samba-dc.example.com/demo /mnt/testshare1 root@focal-dc:/home/ubuntu# stat /mnt/testshare1 File: /mnt/testshare1 Size: 0 Blocks: 0 IO Block: 1048576 directory Device: 36h/54d Inode: 260995 Links: 2 Access: (0755/drwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2025-04-30 06:16:07.320000000 +0000 Modify: 2025-04-30 06:16:07.320000000 +0000 Change: 2025-04-30 06:16:07.320000000 +0000 Birth: - # journalctl -b0 kernel: CIFS: Attempting to mount //samba-dc.example.com/demo kernel: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3), from CIFS (SMB1). To use the > cifs.upcall[1908]: key description: cifs.spnego;0;0;39010000;ver=0x2;host=samba-dc.example.com;ip4=192.168.122.27;sec=krb5;uid=0x0;creduid=0x0;user=root;pid=0x770;upcall_target=app cifs.upcall[1909]: ver=2 cifs.upcall[1909]: host=samba-dc.example.com cifs.upcall[1909]: ip=192.168.122.27 cifs.upcall[1909]: sec=1 cifs.upcall[1909]: uid=0 cifs.upcall[1909]: creduid=0 cifs.upcall[1909]: user=root cifs.upcall[1909]: pid=1904 cifs.upcall[1909]: upcall_target=app cifs.upcall[1908]: upcall_target=app, switching namespaces to application thread cifs.upcall[1908]: get_cachename_from_process_env: pid == 0 cifs.upcall[1908]: get_existing_cc: default ccache is FILE:/tmp/krb5cc_0 cifs.upcall[1908]: handle_krb5_mech: getting service ticket for samba-dc.example.com cifs.upcall[1908]: handle_krb5_mech: obtained service ticket cifs.upcall[1908]: Exit status 0 Note, upcall_target=app is enabled by default. In the docker container: root@focal-dc:/home/ubuntu# docker start 2f1a7761412a 2f1a7761412a root@focal-dc:/home/ubuntu# docker exec -it 2f1a7761412a bash root@2f1a7761412a:/# stat /mnt/shared File: /mnt/shared Size: 0 Blocks: 0 IO Block: 1048576 directory Device: 36h/54d Inode: 260995 Links: 2 Access: (0755/drwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2025-04-30 18:16:07.320000000 +1200 Modify: 2025-04-30 18:16:07.320000000 +1200 Change: 2025-04-30 18:16:07.320000000 +1200 Birth: - On the host: root@focal-dc:/home/ubuntu# kdestroy -c /tmp/krb5cc_0 root@focal-dc:/home/ubuntu# ss -K dport 445 Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port Process tcp ESTAB 0 0 192.168.122.27:54162 192.168.122.27:microsoft-ds On the container: root@2f1a7761412a:/# stat /mnt/shared stat: cannot statx '/mnt/shared': Required key not available On the host: # journalctl -f cifs.upcall[2043]: key description: cifs.spnego;0;0;39010000;ver=0x2;host=samba-dc.example.com;ip4=192.168.122.27;sec=krb5;uid=0x0;creduid=0x0;user=root;pid=0x7fa;upcall_target=app cifs.upcall[2044]: ver=2 cifs.upcall[2044]: host=samba-dc.example.com cifs.upcall[2044]: ip=192.168.122.27 cifs.upcall[2044]: sec=1 cifs.upcall[2044]: uid=0 cifs.upcall[2044]: creduid=0 cifs.upcall[2044]: user=root cifs.upcall[2044]: pid=2042 cifs.upcall[2044]: upcall_target=app cifs.upcall[2043]: upcall_target=app, switching namespaces to application thread cifs.upcall[2043]: get_cachename_from_process_env: pid == 0 cifs.upcall[2043]: get_existing_cc: default ccache is FILE:/tmp/krb5cc_000 cifs.upcall[2043]: check_service_ticket_exists: unable to get client principal from cache: No credentials cache found (filename: /tmp/krb5cc_000) cifs.upcall[2043]: get_tgt_time: unable to get principal cifs.upcall[2043]: main: valid TGT is not present in credential cache cifs.upcall[2043]: krb5_get_init_creds_keytab: -1765328228 cifs.upcall[2043]: Exit status 1 kernel: CIFS VFS: Verify user has a krb5 ticket and keyutils is installed kernel: CIFS VFS: \\samba-dc.example.com Send error in SessSetup = -126 We still have existing behaviour by default: cifs.upcall[2043]: get_existing_cc: default ccache is FILE:/tmp/krb5cc_000 and cifs.upcall[2043]: check_service_ticket_exists: unable to get client principal from cache: No credentials cache found (filename: /tmp/krb5cc_000) which means we will not cause any regressions. Next, we will use the new mount option, "upcall_target=mount": # mount -t cifs -o cruid=root,user=root,sec=krb5i,uid=0,gid=0,cred=/tmp/krb5cc_0,upcall_target=mount //samba-dc.example.com/demo /mnt/testshare1 # journalctl -b0 kernel: CIFS: Attempting to mount //samba-dc.example.com/demo kernel: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3), from CIFS (SMB1). To use the > cifs.upcall[2159]: key description: cifs.spnego;0;0;39010000;ver=0x2;host=samba-dc.example.com;ip4=192.168.122.27;sec=krb5;uid=0x0;creduid=0x0;user=root;pid=0x86b;upcall_target=mount cifs.upcall[2160]: ver=2 cifs.upcall[2160]: host=samba-dc.example.com cifs.upcall[2160]: ip=192.168.122.27 cifs.upcall[2160]: sec=1 cifs.upcall[2160]: uid=0 cifs.upcall[2160]: creduid=0 cifs.upcall[2160]: user=root cifs.upcall[2160]: pid=2155 cifs.upcall[2160]: upcall_target=mount cifs.upcall[2159]: upcall_target=mount, not switching namespaces to application thread cifs.upcall[2159]: get_cachename_from_process_env: pid == 0 cifs.upcall[2159]: get_existing_cc: default ccache is FILE:/tmp/krb5cc_0 cifs.upcall[2159]: main: valid service ticket exists in credential cache cifs.upcall[2159]: handle_krb5_mech: getting service ticket for samba-dc.example.com cifs.upcall[2159]: handle_krb5_mech: obtained service ticket cifs.upcall[2159]: Exit status 0 Now we have upcall_target=mount set. In the container: root@focal-dc:/home/ubuntu# docker start 2f1a7761412a 2f1a7761412a root@focal-dc:/home/ubuntu# docker exec -it 2f1a7761412a bash root@2f1a7761412a:/# stat /mnt/shared File: /mnt/shared Size: 0 Blocks: 0 IO Block: 1048576 directory Device: 36h/54d Inode: 260995 Links: 2 Access: (0755/drwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2025-04-30 18:16:07.320000000 +1200 Modify: 2025-04-30 18:16:07.320000000 +1200 Change: 2025-04-30 18:16:07.320000000 +1200 Birth: - On the host: root@focal-dc:/home/ubuntu# kdestroy -c /tmp/krb5cc_0 root@focal-dc:/home/ubuntu# ss -K dport 445 Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port Process tcp ESTAB 0 0 192.168.122.27:45856 192.168.122.27:microsoft-ds On the container: root@2f1a7761412a:/# stat /mnt/shared stat: cannot stat '/mnt/shared': Required key not available On the host: # journalctl -f cifs.upcall[2301]: key description: cifs.spnego;0;0;39010000;ver=0x2;host=samba-dc.example.com;ip4=192.168.122.27;sec=krb5;uid=0x0;creduid=0x0;user=root;pid=0x8fc;upcall_target=mount cifs.upcall[2302]: ver=2 cifs.upcall[2302]: host=samba-dc.example.com cifs.upcall[2302]: ip=192.168.122.27 cifs.upcall[2302]: sec=1 cifs.upcall[2302]: uid=0 cifs.upcall[2302]: creduid=0 cifs.upcall[2302]: user=root cifs.upcall[2302]: pid=2300 cifs.upcall[2302]: upcall_target=mount cifs.upcall[2301]: upcall_target=mount, not switching namespaces to application thread cifs.upcall[2301]: get_cachename_from_process_env: pid == 0 cifs.upcall[2301]: get_existing_cc: default ccache is FILE:/tmp/krb5cc_0 cifs.upcall[2301]: check_service_ticket_exists: unable to get client principal from cache: No credentials cache found (filename: /tmp/krb5cc_0) cifs.upcall[2301]: get_tgt_time: unable to get principal cifs.upcall[2301]: main: valid TGT is not present in credential cache cifs.upcall[2301]: krb5_get_init_creds_keytab: -1765328378 cifs.upcall[2301]: Exit status 1 kernel: CIFS VFS: Verify user has a krb5 ticket and keyutils is installed kernel: CIFS VFS: \\samba-dc.example.com Send error in SessSetup = -126 Now that "mount" is used, we correctly only use the credential cache from the host namespace, which is FILE:/tmp/krb5cc_0, and we don't leak any data between the container or the host, fixing the security issue. Next we will test: * patched kernel, existing cifs-utils ===================================== kernel: 5.4.0-218-generic from -proposed cifs-utils: 2:6.9-1ubuntu0.2 from -updates If we were to manually specify upcall_target=app on the mount command line: root@samba-dc:/home/ubuntu# mount -t cifs -o cruid=root,user=root,sec=krb5i,uid=0,gid=0,cred=/tmp/krb5cc_0,upcall_target=app //samba-dc.example.com/demo /mnt/testshare1 # journalctl -f kernel: Key type cifs.spnego registered kernel: Key type cifs.idmap registered kernel: CIFS: Attempting to mount //samba-dc.example.com/demo kernel: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3), from CIFS (SMB1). To use the > cifs.upcall[1565]: key description: cifs.spnego;0;0;39010000;ver=0x2;host=samba-dc.example.com;ip4=192.168.122.27;sec=krb5;uid=0x0;creduid=0x0;user=root;pid=0x60a;upcall_target=app cifs.upcall[1566]: ver=2 cifs.upcall[1566]: host=samba-dc.example.com cifs.upcall[1566]: ip=192.168.122.27 cifs.upcall[1566]: sec=1 cifs.upcall[1566]: uid=0 cifs.upcall[1566]: creduid=0 cifs.upcall[1566]: user=root cifs.upcall[1566]: pid=1546 cifs.upcall[1565]: get_cachename_from_process_env: pid == 0 cifs.upcall[1565]: get_existing_cc: default ccache is FILE:/tmp/krb5cc_0 cifs.upcall[1565]: handle_krb5_mech: getting service ticket for samba-dc.example.com cifs.upcall[1565]: handle_krb5_mech: obtained service ticket cifs.upcall[1565]: Exit status 0 The mount continues successfully. The existing cifs-utils does not complain about it. Test with no "upcall_target". e.g.: # mount -t cifs -o cruid=root,user=root,sec=krb5i,uid=0,gid=0,cred=/tmp/krb5cc_0 //samba-dc.example.com/demo /mnt/testshare1 # journalctl -b0 kernel: CIFS: Attempting to mount //samba-dc.example.com/demo kernel: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3), from CIFS (SMB1). To use the > cifs.upcall[1579]: key description: cifs.spnego;0;0;39010000;ver=0x2;host=samba-dc.example.com;ip4=192.168.122.27;sec=krb5;uid=0x0;creduid=0x0;user=root;pid=0x627;upcall_target=app cifs.upcall[1580]: ver=2 cifs.upcall[1580]: host=samba-dc.example.com cifs.upcall[1580]: ip=192.168.122.27 cifs.upcall[1580]: sec=1 cifs.upcall[1580]: uid=0 cifs.upcall[1580]: creduid=0 cifs.upcall[1580]: user=root cifs.upcall[1580]: pid=1575 cifs.upcall[1579]: get_cachename_from_process_env: pid == 0 cifs.upcall[1579]: get_existing_cc: default ccache is FILE:/tmp/krb5cc_0 cifs.upcall[1579]: handle_krb5_mech: getting service ticket for samba-dc.example.com cifs.upcall[1579]: handle_krb5_mech: obtained service ticket cifs.upcall[1579]: Exit status 0 Note, that we still see "upcall_target=app" appended to key description even though this is with existing cifs-utils. The mount still succeeds as normal. Next we will test: * existing kernel, patched cifs-utils ===================================== kernel 5.4.0-216-generic from -updates cifs-utils 2:6.9-1ubuntu0.3 from -security-proposed If we were to manually specify upcall_target=app on the mount command line: # mount -t cifs -o cruid=root,user=root,sec=krb5i,uid=0,gid=0,cred=/tmp/krb5cc_0,upcall_target=app //samba-dc.example.com/demo /mnt/testshare1 mount error(22): Invalid argument Refer to the mount.cifs(8) manual page (e.g. man mount.cifs) and kernel log messages (dmesg) # journalctl -b0 kernel: CIFS: Unknown mount option "upcall_target=app" cifs-utils accepts it, but the kernel does not, and fails with an unknown parameter. This is okay, because the existing kernel does not have support for the new parameter, and users would be manually be adding it to their mount parameters anyway. If they went to this effort, they would notice their kernel is out of date and would upgrade their kernel to get support. Testing with no "upcall_target": # mount -t cifs -o cruid=root,user=root,sec=krb5i,uid=0,gid=0,cred=/tmp/krb5cc_0 //samba-dc.example.com/demo /mnt/testshare1 # mount -l //samba-dc.example.com/demo on /mnt/testshare1 type cifs (rw,relatime,vers=3.1.1,sec=krb5i,cruid=0,cache=strict,username=root,uid=0,forceuid,gid=0,forcegid,addr=192.168.122.27,file_mode=0755,dir_mode=0755,soft,nounix,serverino,mapposix,rsize=4194304,wsize=4194304,bsize=1048576,echo_interval=60,actimeo=1,user=root) # journalctl -f kernel: CIFS: Attempting to mount //samba-dc.example.com/demo kernel: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3), from CIFS (SMB1). To use the > cifs.upcall[2699]: key description: cifs.spnego;0;0;39010000;ver=0x2;host=samba-dc.example.com;ip4=192.168.122.27;sec=krb5;uid=0x0;creduid=0x0;user=root;pid=0xa85 cifs.upcall[2700]: ver=2 cifs.upcall[2700]: host=samba-dc.example.com cifs.upcall[2700]: ip=192.168.122.27 cifs.upcall[2700]: sec=1 cifs.upcall[2700]: uid=0 cifs.upcall[2700]: creduid=0 cifs.upcall[2700]: user=root cifs.upcall[2700]: pid=2693 cifs.upcall[2699]: upcall_target=app, switching namespaces to application thread cifs.upcall[2699]: get_cachename_from_process_env: pid == 0 cifs.upcall[2699]: get_existing_cc: default ccache is FILE:/tmp/krb5cc_0 cifs.upcall[2699]: main: valid service ticket exists in credential cache cifs.upcall[2699]: handle_krb5_mech: getting service ticket for samba-dc.example.com cifs.upcall[2699]: handle_krb5_mech: obtained service ticket cifs.upcall[2699]: Exit status 0 Mounting shares without any additional mount parameters still works correctly. cifs-utils does not append upcall_target=app to the mount command line, so existing kernel continues to work correctly. Note, it does now mention: cifs.upcall[2699]: upcall_target=app, switching namespaces to application thread to say that it uses the current process namespace, which is the same as existing behaviour. We have covered all situations of the testing matrix. Both the kernel in -proposed and cifs-utils in -security-proposed fix the issue, and don't cause any issues being installed independently with or without each other. Happy to mark verified for focal. ** Tags removed: verification-needed-focal-linux ** Tags added: verification-done-focal verification-done-focal-linux -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2099914 Title: CVE-2025-2312 cifs.upcall could access incorrect kerberos credentials cache To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/cifs-utils/+bug/2099914/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
