A security issue was found in cifs-utils in versions before 6.13. When a container process causes an operation that trigger the kernel to ask a userspace for user credentials for an SMB filesystem, cifs.upcall utility may indirectly leak an information about Kerberos credentials available in the host environment and cause non-sanctioned SMB filesystem access in the container.
A security issue was found in cifs-utils in versions before 6.13. When a container process causes an operation that trigger the kernel to ask a userspace for user credentials for an SMB filesystem, cifs.upcall utility may indirectly leak an information about Kerberos credentials available in the host environment and cause non-sanctioned SMB filesystem access in the container.
https://lists.samba.org/archive/samba-technical/2021-April/136467.html https://bugzilla.samba.org/show_bug.cgi?id=14651 https://git.samba.org/?p=cifs-utils.git;a=commitdiff;h=e461afd8cfa6d0781ae0c5c10e89b6ef1ca6da32
Workaround ========== For host systems that cannot be updated, DFS and multiuser mounts can be disabled in the container SMB mounts options i.e. adding 'nodfs' and removing 'multiuser' (if present).
Vulmon