CVE-2025-2312: cifs.upcall makes an upcall to the wrong namespace in containerized environments
A flaw was found in cifs-utils. When trying to obtain Kerberos credentials, the cifs.upcall program from the cifs-utils package makes an upcall to the wrong namespace in containerized environments. This issue may lead to disclosing sensitive data from the host's Kerberos credentials cache.
Other sources
While trying to get Kerberos credentials, cifs.upcall program from the cifs-utils package makes an upcall to the wrong namespace in containerized environments. This may lead to a disclosure of sensitive data from the host's Kerberos credentials cache.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/cifs-utilsto a version that resolves this vulnerability.Fixed in 2:6.11-3.1+deb11u2Fixed in 2:6.11-3.1+deb11u1Fixed in 2:7.3-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-2312?
CVE-2025-2312 is classified as a medium severity vulnerability that could lead to the disclosure of sensitive Kerberos credentials.
How do I fix CVE-2025-2312?
To fix CVE-2025-2312, update to the latest version of the cifs-utils package that includes the patch for this vulnerability.
Who is affected by CVE-2025-2312?
CVE-2025-2312 affects systems running cifs-utils, particularly in containerized environments where Kerberos credentials may be improperly handled.
What kind of data can be exposed due to CVE-2025-2312?
CVE-2025-2312 may lead to the exposure of sensitive Kerberos credentials that could compromise system security.
Is CVE-2025-2312 a common vulnerability?
CVE-2025-2312, while not extremely widespread, poses a significant risk in environments utilizing cifs-utils and Kerberos for authentication.