Skip to content

Commit 7cd9165

Browse files
committed
Patch cifs-utils to address CVE-2025-2312 [Medium] (#13198)
(cherry picked from commit 18d079a)
1 parent 7ee00c7 commit 7cd9165

2 files changed

Lines changed: 139 additions & 1 deletion

File tree

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
From 80c4d726a5c5eeab9b9cfb47692ceec25f444d3b Mon Sep 17 00:00:00 2001
2+
From: Ritvik Budhiraja <rbudhiraja@microsoft.com>
3+
Date: Tue, 19 Nov 2024 06:07:58 +0000
4+
Subject: [PATCH] CIFS.upcall to accomodate new namespace mount opt
5+
6+
NOTE: This patch is dependent on one of the previously sent patches:
7+
[PATCH] CIFS: New mount option for cifs.upcall namespace resolution
8+
which introduces a new mount option called upcall_target, to
9+
customise the upcall behaviour.
10+
11+
Building upon the above patch, the following patch adds functionality
12+
to handle upcall_target as a mount option in cifs.upcall. It can have 2 values -
13+
mount, app.
14+
Having this new mount option allows the mount command to specify where the
15+
upcall should happen: 'mount' for resolving the upcall to the host
16+
namespace, and 'app' for resolving the upcall to the ns of the calling
17+
thread. This will enable both the scenarios where the Kerberos credentials
18+
can be found on the application namespace or the host namespace to which
19+
just the mount operation is "delegated".
20+
This aids use cases like Kubernetes where the mount
21+
happens on behalf of the application in another container altogether.
22+
23+
Signed-off-by: Ritvik Budhiraja <rbudhiraja@microsoft.com>
24+
Signed-off-by: Steve French <stfrench@microsoft.com>
25+
---
26+
cifs.upcall.c | 55 +++++++++++++++++++++++++++++++++++++++++++--------
27+
1 file changed, 47 insertions(+), 8 deletions(-)
28+
29+
diff --git a/cifs.upcall.c b/cifs.upcall.c
30+
index ad04301..1885273 100644
31+
--- a/cifs.upcall.c
32+
+++ b/cifs.upcall.c
33+
@@ -801,6 +801,13 @@ struct decoded_args {
34+
#define MAX_USERNAME_SIZE 256
35+
char username[MAX_USERNAME_SIZE + 1];
36+
37+
+#define MAX_UPCALL_STRING_LEN 6 /* "mount\0" */
38+
+ enum upcall_target_enum {
39+
+ UPTARGET_UNSPECIFIED, /* not specified, defaults to app */
40+
+ UPTARGET_MOUNT, /* upcall to the mount namespace */
41+
+ UPTARGET_APP, /* upcall to the application namespace which did the mount */
42+
+ } upcall_target;
43+
+
44+
uid_t uid;
45+
uid_t creduid;
46+
pid_t pid;
47+
@@ -817,6 +824,7 @@ struct decoded_args {
48+
#define DKD_HAVE_PID 0x20
49+
#define DKD_HAVE_CREDUID 0x40
50+
#define DKD_HAVE_USERNAME 0x80
51+
+#define DKD_HAVE_UPCALL_TARGET 0x100
52+
#define DKD_MUSTHAVE_SET (DKD_HAVE_HOSTNAME|DKD_HAVE_VERSION|DKD_HAVE_SEC)
53+
int have;
54+
};
55+
@@ -827,6 +835,7 @@ __decode_key_description(const char *desc, struct decoded_args *arg)
56+
size_t len;
57+
char *pos;
58+
const char *tkn = desc;
59+
+ arg->upcall_target = UPTARGET_UNSPECIFIED;
60+
61+
do {
62+
pos = index(tkn, ';');
63+
@@ -925,6 +934,31 @@ __decode_key_description(const char *desc, struct decoded_args *arg)
64+
}
65+
arg->have |= DKD_HAVE_VERSION;
66+
syslog(LOG_DEBUG, "ver=%d", arg->ver);
67+
+ } else if (strncmp(tkn, "upcall_target=", 14) == 0) {
68+
+ if (pos == NULL)
69+
+ len = strlen(tkn);
70+
+ else
71+
+ len = pos - tkn;
72+
+
73+
+ len -= 14;
74+
+ if (len > MAX_UPCALL_STRING_LEN) {
75+
+ syslog(LOG_ERR, "upcall_target= value too long for buffer");
76+
+ return 1;
77+
+ }
78+
+ if (strncmp(tkn + 14, "mount", 5) == 0) {
79+
+ arg->upcall_target = UPTARGET_MOUNT;
80+
+ syslog(LOG_DEBUG, "upcall_target=mount");
81+
+ } else if (strncmp(tkn + 14, "app", 3) == 0) {
82+
+ arg->upcall_target = UPTARGET_APP;
83+
+ syslog(LOG_DEBUG, "upcall_target=app");
84+
+ } else {
85+
+ // Should never happen
86+
+ syslog(LOG_ERR, "Invalid upcall_target value: %s, defaulting to app",
87+
+ tkn + 14);
88+
+ arg->upcall_target = UPTARGET_APP;
89+
+ syslog(LOG_DEBUG, "upcall_target=app");
90+
+ }
91+
+ arg->have |= DKD_HAVE_UPCALL_TARGET;
92+
}
93+
if (pos == NULL)
94+
break;
95+
@@ -1289,15 +1323,20 @@ int main(const int argc, char *const argv[])
96+
* acceptably in containers, because we'll be looking at the correct
97+
* filesystem and have the correct network configuration.
98+
*/
99+
- rc = switch_to_process_ns(arg->pid);
100+
- if (rc == -1) {
101+
- syslog(LOG_ERR, "unable to switch to process namespace: %s", strerror(errno));
102+
- rc = 1;
103+
- goto out;
104+
+ if (arg->upcall_target == UPTARGET_APP || arg->upcall_target == UPTARGET_UNSPECIFIED) {
105+
+ syslog(LOG_INFO, "upcall_target=app, switching namespaces to application thread");
106+
+ rc = switch_to_process_ns(arg->pid);
107+
+ if (rc == -1) {
108+
+ syslog(LOG_ERR, "unable to switch to process namespace: %s", strerror(errno));
109+
+ rc = 1;
110+
+ goto out;
111+
+ }
112+
+ if (trim_capabilities(env_probe))
113+
+ goto out;
114+
+ } else {
115+
+ syslog(LOG_INFO, "upcall_target=mount, not switching namespaces to application thread");
116+
}
117+
118+
- if (trim_capabilities(env_probe))
119+
- goto out;
120+
121+
/*
122+
* The kernel doesn't pass down the gid, so we resort here to scraping
123+
@@ -1344,7 +1383,7 @@ int main(const int argc, char *const argv[])
124+
* look at the environ file.
125+
*/
126+
env_cachename =
127+
- get_cachename_from_process_env(env_probe ? arg->pid : 0);
128+
+ get_cachename_from_process_env((env_probe && (arg->upcall_target == UPTARGET_APP)) ? arg->pid : 0);
129+
130+
rc = setuid(uid);
131+
if (rc == -1) {
132+
--
133+
2.34.1
134+

SPECS/cifs-utils/cifs-utils.spec

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Summary: cifs client utils
22
Name: cifs-utils
33
Version: 6.14
4-
Release: 2%{?dist}
4+
Release: 3%{?dist}
55
License: GPLv3
66
Vendor: Microsoft Corporation
77
Distribution: Mariner
@@ -10,6 +10,7 @@ URL: https://wiki.samba.org/index.php/LinuxCIFS_utils
1010
Source0: https://download.samba.org/pub/linux-cifs/%{name}/%{name}-%{version}.tar.bz2
1111
Patch0: CVE-2022-29869.patch
1212
Patch1: CVE-2022-27239.patch
13+
Patch2: CVE-2025-2312.patch
1314
BuildRequires: keyutils-devel
1415
BuildRequires: libcap-ng-devel
1516
BuildRequires: libtalloc-devel
@@ -72,6 +73,9 @@ make %{?_smp_mflags} check
7273
%{_includedir}/cifsidmap.h
7374

7475
%changelog
76+
* Mon Mar 31 2025 Ankita Pareek <ankitapareek@microsoft.com> - 6.14-3
77+
- Add patch for CVE-2025-2312
78+
7579
* Tue May 17 2022 Chris Co <chrco@microsoft.com> - 6.14-2
7680
- Address CVE-2022-27239, CVE-2022-29869
7781
- Fix lint

0 commit comments

Comments
 (0)