Re: [PATCH] mount.cifs: prevent stolen creds through SUDO_UID

Hello Steve and Paulo,

Yes. I applied the exact patch to cifs-utils 7.7 at
3a7dc396306654aa225c35767e56ac1fb239922e, built it successfully, and tested=
 the ENOKEY retry decision using matched unpatched and patched setuid binar=
ies.

The results were:

- Unpatched direct setuid invocation (ruid=3D1000, euid=3D0, caller-control=
led SUDO_UID=3D4242): the ENOKEY retry added cruid=3D4242.
- Patched with the same identity and environment: no retry occurred and no =
cruid option was constructed.
- Patched root/sudo invocation (ruid=3D0, euid=3D0, SUDO_UID=3D4242): the r=
etry retained cruid=3D4242, preserving the intended sudo behavior.

My conclusion is that the patch closes the demonstrated SUDO_UID-to-cruid c=
redential-selection issue. I am also happy to test the final committed vers=
ion.

For clarity, this validation is specific to the SUDO_UID issue. The separat=
e credential-file TOCTOU/privilege-drop case and the remaining Low parse_un=
c hardening item are independent and are not addressed by this change.

Thank you for the quick fix and for including the credit.



Best Regards,

Daniel Birtwhistle
Senior Director Product Security & Assessment

________________________________________
From: Paulo Alcantara <[email protected]>
Sent: Tuesday, July 28, 2026 7:35 PM
To: Pavel Shilovsky
Cc: Birtwhistle, Daniel; Paulo Alcantara (Red Hat); Steve French; linux-cif=
[email protected]
Subject: [PATCH] mount.cifs: prevent stolen creds through SUDO_UID

CAUTION: This email originated from outside of GE HealthCare. Only open lin=
ks or attachments if you trust the sender. Report suspicious emails using O=
utlook=92s =93Report=94 button.

When mount.cifs is invoked with setuid, a non-root user may set
SUDO_UID to be used on the retry kerberos authentication path,
therefore allowing it to mount shares by using credential caches from
different users in the system.

Fix this by trusting the value of SUDO_UID only when mount.cifs is
being executed by sudo or root.

Fixes: 1a1507654c5f ("mount.cifs: use SUDO_UID env variable for cruid")
Reported-by: Daniel Birtwhistle <[email protected]>
Signed-off-by: Paulo Alcantara (Red Hat) <[email protected]>
Cc: Steve French <[email protected]>
Cc: [email protected]
---
 mount.cifs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mount.cifs.c b/mount.cifs.c
index b57c7d346f42..f0e9bc7beae2 100644
--- a/mount.cifs.c
+++ b/mount.cifs.c
@@ -2145,7 +2145,7 @@ int main(int argc, char **argv)
        int rc =3D 0;
        int already_uppercased =3D 0;
        int sloppy =3D 0;
-       int fallback_sudo_uid =3D 0;
+       int fallback_sudo_uid =3D geteuid() || getuid();
        size_t options_size =3D MAX_OPTIONS_LEN;
        struct parsed_mount_info *parsed_info =3D NULL;
        struct parsed_mount_info *reinit_parsed_info =3D NULL;
--
2.55.0