** Description changed:
[Impact]
Unfortunately, the release of CVE-2025-2312 caused a minor regression for some
users of cifs-utils, particularly those with AD users mounting shares from
non-standard UID numbers that aren't the default 0 or 1000.
Trying to mount a share with credentials in environment variables like
$KRB5CCNAME gets messages like:
$ echo $KRB5CCNAME
/tmp/krb5cc_11200
$ sudo mount -t cifs -o sec=krb5i //samba-dc.example.com/demo /mnt/testshare1
mount error(126): Required key not available
Refer to the mount.cifs(8) manual page (e.g. man mount.cifs) and kernel log
messages (dmesg)
Affected packages:
questing: 2:7.3-1
plucky: 2:7.2-2
oracular: 2:7.0-2.1ubuntu0.1
noble: 2:7.0-2ubuntu0.1
jammy: 2:6.14-1ubuntu0.2
focal: 2:6.9-1ubuntu0.3
We changed debian/patches/CVE-2025-2312-1.patch:
@@ -1384,7 +1423,7 @@
* look at the environ file.
*/
env_cachename =
- get_cachename_from_process_env(env_probe ? arg->pid : 0);
+ get_cachename_from_process_env((env_probe && (arg->upcall_target ==
UPTARGET_APP)) ? arg->pid : 0);
rc = setuid(uid);
if (rc == -1) {
Unfortunately, we missed the UPTARGET_UNSPECIFIED option.
- The fix should have been:
- + get_cachename_from_process_env((env_probe &&
(arg->upcall_target == UPTARGET_APP || arg->upcall_target ==
UPTARGET_UNSPECIFIED)) ? arg->pid : 0);
+ The fix from Henrique Carvalho simply sets upcall_target to be UPTARGET_APP
+ if UPTARGET_UNSPECIFIED is the current option.
This affects users who use the non-patched kernels.
I'm broken, please get me a fix / Workarounds:
1) You can install the test packages in the [Testcase] section.
or
2) You can enable -proposed and install any of the 5.4.0-218-generic,
5.15.0-142-generic, 6.8.0-62-generic or 6.11.0-28-generic kernels.
or
3) You can edit the following files:
/etc/krb5.conf - Add this to [libdefaults]:
default_ccache_name = /tmp/krb5cc_%{uid}
/etc/sssd/sssd.conf - Add this to [domain]
krb5_ccachedir = /tmp
krb5_ccname_template = FILE:%d/krb5cc_%{uid}
Ideally restart sssd so sssd-pam can find the kerberos crediental cache again.
sudo systemctl restart sssd
+ or
+ 4) you can simply downgrade the package to what is in the release pocket.
[Testcase]
Follow the entire testcase of
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2099914
first.
$ kinit administrator
Password for administra...@samba-dc.example.com:
Warning: Your password will expire in 36 days on Sat Jul 12 01:54:39 2025
$ klist
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: administra...@samba-dc.example.com
Valid starting Expires Service principal
06/05/25 21:44:07 06/06/25 07:44:07
krbtgt/samba-dc.example....@samba-dc.example.com
renew until 06/06/25 21:44:04
$ mv /tmp/krb5cc_1000 /tmp/krb5cc_11200
$ klist /tmp/krb5cc_11200
Ticket cache: FILE:/tmp/krb5cc_11200
Default principal: administra...@samba-dc.example.com
Valid starting Expires Service principal
06/05/25 21:44:07 06/06/25 07:44:07
krbtgt/samba-dc.example....@samba-dc.example.com
renew until 06/06/25 21:44:04
$ export KRB5CCNAME=/tmp/krb5cc_11200
$ sudo mount -t cifs -o sec=krb5i //samba-dc.example.com/demo /mnt/testshare1
mount error(126): Required key not available
Refer to the mount.cifs(8) manual page (e.g. man mount.cifs) and kernel log
messages (dmesg)
$ journalctl -b0
kernel: CIFS: Attempting to mount //samba-dc.example.com/demo
cifs.upcall[5177]: key description:
cifs.spnego;0;0;39010000;ver=0x2;host=samba-dc.example.com;ip4=192.168.122.248;sec=krb5;uid=0x0;creduid=0x3e8;user=root;pid=0x142c
cifs.upcall[5178]: ver=2
cifs.upcall[5178]: host=samba-dc.example.com
cifs.upcall[5178]: ip=192.168.122.248
cifs.upcall[5178]: sec=1
cifs.upcall[5178]: uid=0
cifs.upcall[5178]: creduid=1000
cifs.upcall[5178]: user=root
cifs.upcall[5178]: pid=5164
cifs.upcall[5177]: upcall_target=app, switching namespaces to application
thread
cifs.upcall[5177]: get_cachename_from_process_env: pid == 0
cifs.upcall[5177]: get_existing_cc: default ccache is FILE:/tmp/krb5cc_1000
cifs.upcall[5177]: check_service_ticket_exists: unable to get client
principal from cache: No credentials cache found (filename: /tmp/krb5cc_1000)
cifs.upcall[5177]: get_tgt_time: unable to get principal
cifs.upcall[5177]: main: valid TGT is not present in credential cache
cifs.upcall[5177]: krb5_get_init_creds_keytab: -1765328378
cifs.upcall[5177]: handle_krb5_mech: getting service ticket for
samba-dc.example.com
cifs.upcall[5177]: handle_krb5_mech: using GSS-API
cifs.upcall[5177]: GSS-API error init_sec_context: No credentials were
supplied, or the credentials were unavailable or inaccessible
cifs.upcall[5177]: GSS-API error init_sec_context: No Kerberos credentials
available (default cache: FILE:/tmp/krb5cc_1000)
cifs.upcall[5177]: handle_krb5_mech: failed to obtain service ticket via GSS
(458752)
cifs.upcall[5177]: Unable to obtain service ticket
cifs.upcall[5177]: Exit status 458752
kernel: CIFS: VFS: Verify user has a krb5 ticket and keyutils is installed
kernel: CIFS: VFS: \\samba-dc.example.com Send error in SessSetup = -126
kernel: CIFS: VFS: cifs_mount failed w/return code = -126
If you install the test packages in the following ppa:
https://launchpad.net/~mruffell/+archive/ubuntu/sf407276-regression-test
Please note this package is NOT SUPPORTED by Canonical, and is for TESTING
PURPOSES ONLY. ONLY Install in a dedicated test environment.
Instructions to Install (On a focal, jammy, noble, oracular, plucky system):
1) sudo add-apt-repository ppa:mruffell/sf407276-regression-test
2) sudo apt update
3) sudo apt install cifs-utils
4) sudo apt-cache policy cifs-utils | grep Installed
Check for +sf407276v20250531b1
The share mounts normally as expected.
[Where problems can occur]
This is a part of the fix of CVE-2025-2312, and we need to make sure that we
again, test the following scenarios:
* patched kernel, patched cifs-utils
* patched kernel, existing cifs-utils
* existing kernel, patched cifs-utils
This time, we really need to spend a bit more time on the unpatched kernel
scenario, because clearly I wasn't thorough enough.
If a regression were to occur, it could affect mounting of cifs / smb shares
and
users would not be able to access their data.
Due to the nature of this bug, there is no secret leakage from
CVE-2025-2312.
[Other info]
This regression was caused in:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2099914
+
+ This has been fixed upstream in cifs-utils 7.4 by:
+
+ commit f4fd27cf60d6431d83ea18b4962aef845f9312bd
+ Author: Henrique Carvalho <henrique.carva...@suse.com>
+ Date: Fri May 30 12:28:14 2025 -0300
+ Subject: cifs.upcall: correctly treat UPTARGET_UNSPECIFIED as UPTARGET_APP
+ Link:
https://git.samba.org/?p=cifs-utils.git;a=commit;h=f4fd27cf60d6431d83ea18b4962aef845f9312bd
+
+ Mailing list link:
+
https://lore.kernel.org/linux-cifs/20250530152814.1592508-1-henrique.carva...@suse.com/T/
+
+ Note, there is an additional regression caused by:
https://bugs.launchpad.net/ubuntu/+source/cifs-utils/+bug/2099917
-
- I have asked cifs-utils maintainers to land the following change in upstream
- cifs-utils as soon as possible:
-
- diff --git a/cifs.upcall.c b/cifs.upcall.c
- index 678b140..e23a887 100644
- --- a/cifs.upcall.c
- +++ b/cifs.upcall.c
- @@ -1573,7 +1573,7 @@ int main(const int argc, char *const argv[])
- * look at the environ file.
- */
- env_cachename =
- - get_cachename_from_process_env((env_probe &&
(arg->upcall_target == UPTARGET_APP)) ? arg->pid : 0);
- + get_cachename_from_process_env((env_probe &&
(arg->upcall_target == UPTARGET_APP || arg->upcall_target ==
UPTARGET_UNSPECIFIED)) ? arg->pid : 0);
-
- rc = setuid(uid);
- if (rc == -1) {
-
- Once this lands and we have providence for the fix, I will make new packages
- and get the Security Team to sponsor immediately.
+ that is getting fixed in:
+ https://bugs.launchpad.net/ubuntu/+source/cifs-utils/+bug/2113906
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2112614
Title:
Regression: After CVE-2025-2312 cifs.upcall can't find credential
caches from user env
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/cifs-utils/+bug/2112614/+subscriptions
--
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
