{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/cifs-utils-7.0---7.6/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["cifs-utils (7.0 - 7.6)"],"_cs_severities":["high"],"_cs_tags":["privilege-escalation","linux","cifs-utils"],"_cs_type":"advisory","_cs_vendors":["Samba"],"content_html":"\u003cp\u003eCVE-2026-104715 is a critical local privilege escalation vulnerability affecting the \u003ccode\u003emount.cifs\u003c/code\u003e utility within the \u003ccode\u003ecifs-utils\u003c/code\u003e package. The vulnerability stems from improper sanitization of the \u003ccode\u003eusername\u003c/code\u003e field within credential files provided via the \u003ccode\u003ecredentials=\u003c/code\u003e mount option. Because \u003ccode\u003emount.cifs\u003c/code\u003e copies the \u003ccode\u003eusername\u003c/code\u003e value into the kernel-bound mount option string without filtering for comma separators, an attacker who controls a local credential file can inject arbitrary mount parameters. Since the Linux kernel CIFS parser follows a last-write-wins logic, these injected parameters override earlier, legitimate security settings. By successfully injecting options such as \u003ccode\u003euid=0\u003c/code\u003e, \u003ccode\u003eforceuid\u003c/code\u003e, and \u003ccode\u003efile_mode=04755\u003c/code\u003e, an attacker can gain a root shell through privileged mount operations performed by administrators, systemd units, or autofs. The vulnerability affects \u003ccode\u003ecifs-utils\u003c/code\u003e versions 7.0 through 7.6 and bypasses SELinux targeted policies.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a local \u003ccode\u003ecredentials\u003c/code\u003e file or path that is currently or will be used by \u003ccode\u003emount.cifs\u003c/code\u003e with root privileges.\u003c/li\u003e\n\u003cli\u003eAttacker modifies the credentials file, injecting malicious options into the \u003ccode\u003eusername\u003c/code\u003e field (e.g., \u003ccode\u003eusername=user,uid=0,forceuid,file_mode=04755\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eA privileged process (e.g., administrator, systemd, or autofs) triggers a mount operation using the compromised credential file.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003emount.cifs\u003c/code\u003e parses the file and concatenates the malicious \u003ccode\u003eusername\u003c/code\u003e string into the kernel mount option buffer.\u003c/li\u003e\n\u003cli\u003eThe kernel parses the final mount option string; due to the last-write-wins behavior, the injected \u003ccode\u003euid=0\u003c/code\u003e and permission-altering options override the default system settings.\u003c/li\u003e\n\u003cli\u003eThe CIFS share is mounted with the attacker's desired permissions, effectively granting the attacker full control over file ownership and SUID bits on the mounted filesystem.\u003c/li\u003e\n\u003cli\u003eAttacker executes a binary or modifies files on the now-accessible share to gain persistence or escalate to a root shell.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full local privilege escalation, allowing an unprivileged user to gain root access. This affects any system using \u003ccode\u003ecifs-utils\u003c/code\u003e for network filesystem management, including enterprise distributions such as Ubuntu 24.04 and RHEL 9.8. The attack is particularly dangerous because it does not require setuid permissions on \u003ccode\u003emount.cifs\u003c/code\u003e or the presence of \u003ccode\u003epam_mount\u003c/code\u003e, and it remains effective even when SELinux is in enforcing mode.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePrioritize updating \u003ccode\u003ecifs-utils\u003c/code\u003e to versions containing the fix provided by the maintainer (Paulo Alcantara) to enforce sanitization of credential file values.\u003c/li\u003e\n\u003cli\u003eAudit all \u003ccode\u003efstab\u003c/code\u003e entries, systemd \u003ccode\u003e.mount\u003c/code\u003e units, and administrative scripts that use the \u003ccode\u003ecredentials=\u003c/code\u003e mount option to ensure credential files are stored in directories with restricted write access.\u003c/li\u003e\n\u003cli\u003eRestrict write access to any files used as CIFS credentials to the specific user account authorized to use that share, preventing unauthorized injection.\u003c/li\u003e\n\u003cli\u003eMonitor system logs for unexpected or unauthorized mount operations, particularly those involving modifications to credential configuration files.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-15T23:05:21Z","date_published":"2026-10-15T23:05:21Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cifs-utils-lpe/","summary":"A local privilege escalation vulnerability in cifs-utils (CVE-2026-104715) allows unprivileged users to gain root access by injecting malicious mount options into a user-controlled credentials file used by mount.cifs.","title":"Local Privilege Escalation in cifs-utils via Credential File Injection","url":"https://feed.craftedsignal.io/briefs/2026-10-cifs-utils-lpe/"}],"language":"en","title":"CraftedSignal Threat Feed - Cifs-Utils (7.0 - 7.6)","version":"https://jsonfeed.org/version/1.1"}