CVE-2025-2312
cifs.upcall makes an upcall to the wrong namespace in containerized environments
Summary
cifs.upcall makes an upcall to the wrong namespace in containerized environments
Original description
The description as published by the source.
A flaw was found in cifs-utils. When trying to obtain Kerberos credentials, the cifs.upcall program from the cifs-utils package makes an upcall to the wrong namespace in containerized environments. This issue may lead to disclosing sensitive data from the host's Kerberos credentials cache.
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2025-2312 cifs-utils
- Ubuntu UBUNTU-CVE-2025-2312 cifs-utils
References
- advisory github.com
- advisory nvd.nist.gov
- patch git.samba.org
- patch web.git.kernel.org