| Name | CVE-2025-2312 |
| Description | A flaw was found in cifs-utils. When trying to obtain Kerberos credentials, the cifs.upcall program from the cifs-utils package makes an upcall to the wrong namespace in containerized environments. This issue may lead to disclosing sensitive data from the host's Kerberos credentials cache. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| cifs-utils (PTS) | bullseye | 2:6.11-3.1+deb11u2 | fixed |
| bullseye (security) | 2:6.11-3.1+deb11u1 | fixed |
| bookworm | 2:7.0-2 | vulnerable |
| trixie, sid | 2:7.3-1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|
| cifs-utils | source | bullseye | (not affected) | | | |
| cifs-utils | source | (unstable) | 2:7.2-1 | | | |
Notes
[bookworm] - cifs-utils <no-dsa> (Minor issue; needs corresponding kernel change)
[bullseye] - cifs-utils <not-affected> (The vulnerable code was introduced later)
https://bugzilla.redhat.com/show_bug.cgi?id=2352604
Depends on change on kernel: https://git.kernel.org/linus/db363b0a1d9e6b9dc556296f1b1007aeb496a8cf (6.13-rc1)
Fixed by: https://git.samba.org/?p=cifs-utils.git;a=commit;h=89b679228cc1be9739d54203d28289b03352c174 (7.2)
Documentation update: https://git.samba.org/?p=cifs-utils.git;a=commit;h=cf63240489431e98033e599a7c9437b59494a2e4 (7.2)