| Description |
| - |
A flaw was found in cifs-utils in versions before 6.13. A user when mounting a krb5 CIFS file system from within a container can use Kerberos credentials of the host. |
| + |
A security issue was found in cifs-utils in versions before 6.13. When a container process causes an operation that trigger the kernel to ask a userspace for user credentials for an SMB filesystem, cifs.upcall utility may indirectly leak an information about Kerberos credentials available in the host environment and cause non-sanctioned SMB filesystem access in the container. |
|
| References |
| - |
https://bugzilla.redhat.com/show_bug.cgi?id=1921116 |
| + |
https://lists.samba.org/archive/samba-technical/2021-April/136467.html |
| |
https://bugzilla.samba.org/show_bug.cgi?id=14651 |
| |
https://git.samba.org/?p=cifs-utils.git;a=commitdiff;h=e461afd8cfa6d0781ae0c5c10e89b6ef1ca6da32 |
|
| Notes |
| + |
Workaround |
| + |
========== |
| + |
|
| + |
For host systems that cannot be updated, DFS and multiuser mounts can be disabled in the container SMB mounts options i.e. adding 'nodfs' and removing 'multiuser' (if present). |
|