CVE-2025-2312

Published: Mar 25, 2025Modified: Jun 17, 2026Deferred

5.9

Vector

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

Exploitability: 1.4 / Impact: 4.0

Source: 74b3a70d-cca6-4d34-9789-e83b222ae3be (Secondary)

Description

A flaw was found in cifs-utils. When trying to obtain Kerberos credentials, the cifs.upcall program from the cifs-utils package makes an upcall to the wrong namespace in containerized environments. This issue may lead to disclosing sensitive data from the host's Kerberos credentials cache.

Related CWEs

CWE-488

Exposure of Data Element to Wrong Session

The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.

References (2)

https://git.samba.org/?p=cifs-utils.git;a=commit;h=89b679228cc1be9739d54203d28289b03352c174

Source: 74b3a70d-cca6-4d34-9789-e83b222ae3be

https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/fs/smb?id=db363b0a1d9e6b9dc556296f1b1007aeb496a8cf

Source: 74b3a70d-cca6-4d34-9789-e83b222ae3be

Timeline

No history available yet.