cifs-utils credential-file flaw can escalate local privileges
Original title: USN-8938-1: cifs-utils vulnerability
A local attacker may inject arbitrary mount options into privileged mount.cifs calls. Ubuntu notice USN-8938-1 covers the issue.
Ubuntu security notice USN-8938-1 says cifs-utils incorrectly handled credentials files used by privileged mount.cifs invocations. A local attacker could possibly inject arbitrary mount options into a privileged mount and gain higher privileges. The notice snippet does not list affected or fixed versions or say whether the flaw is being exploited.
Unconfirmed: The snippet says a local attacker could possibly exploit the issue; exploitation status is not stated.
- The issue is in credentials files used by privileged mount.cifs.
- Impact described is local privilege escalation via injected mount options.
- No affected versions, fixed versions or CVE id appear in the snippet.
Impact: Local privilege escalation via injected mount options
| Product | Affected |
|---|---|
| Ubuntu cifs-utils | — |
- Vendors
- Ubuntu
- Products
- cifs-utils
From the original article
It was discovered that cifs-utils incorrectly handled credentials files used by privileged mount. cifs invocations. A local attacker could possibly use this issue to inject arbitrary mount options into a privileged mount, resulting in a privilege escalation.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.