Re: [PATCH] mount.cifs: prevent stolen creds through SUDO_UID

merged into cifs-utils and smb3-utils for-next

On Wed, Jul 29, 2026 at 2:32=E2=80=AFPM Birtwhistle, Daniel
<[email protected]> wrote:
>
> Hello Steve and Paulo,
>
> Yes. I applied the exact patch to cifs-utils 7.7 at
> 3a7dc396306654aa225c35767e56ac1fb239922e, built it successfully, and test=
ed the ENOKEY retry decision using matched unpatched and patched setuid bin=
aries.
>
> The results were:
>
> - Unpatched direct setuid invocation (ruid=3D1000, euid=3D0, caller-contr=
olled SUDO_UID=3D4242): the ENOKEY retry added cruid=3D4242.
> - Patched with the same identity and environment: no retry occurred and n=
o cruid option was constructed.
> - Patched root/sudo invocation (ruid=3D0, euid=3D0, SUDO_UID=3D4242): the=
 retry retained cruid=3D4242, preserving the intended sudo behavior.
>
> My conclusion is that the patch closes the demonstrated SUDO_UID-to-cruid=
 credential-selection issue. I am also happy to test the final committed ve=
rsion.
>
> For clarity, this validation is specific to the SUDO_UID issue. The separ=
ate credential-file TOCTOU/privilege-drop case and the remaining Low parse_=
unc hardening item are independent and are not addressed by this change.
>
> Thank you for the quick fix and for including the credit.
>
>
>
> Best Regards,
>
> Daniel Birtwhistle
> Senior Director Product Security & Assessment
>
> ________________________________________
> From: Paulo Alcantara <[email protected]>
> Sent: Tuesday, July 28, 2026 7:35 PM
> To: Pavel Shilovsky
> Cc: Birtwhistle, Daniel; Paulo Alcantara (Red Hat); Steve French; linux-c=
[email protected]
> Subject: [PATCH] mount.cifs: prevent stolen creds through SUDO_UID
>
> CAUTION: This email originated from outside of GE HealthCare. Only open l=
inks or attachments if you trust the sender. Report suspicious emails using=
 Outlook=E2=80=99s =E2=80=9CReport=E2=80=9D button.
>
> When mount.cifs is invoked with setuid, a non-root user may set
> SUDO_UID to be used on the retry kerberos authentication path,
> therefore allowing it to mount shares by using credential caches from
> different users in the system.
>
> Fix this by trusting the value of SUDO_UID only when mount.cifs is
> being executed by sudo or root.
>
> Fixes: 1a1507654c5f ("mount.cifs: use SUDO_UID env variable for cruid")
> Reported-by: Daniel Birtwhistle <[email protected]>
> Signed-off-by: Paulo Alcantara (Red Hat) <[email protected]>
> Cc: Steve French <[email protected]>
> Cc: [email protected]
> ---
>  mount.cifs.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/mount.cifs.c b/mount.cifs.c
> index b57c7d346f42..f0e9bc7beae2 100644
> --- a/mount.cifs.c
> +++ b/mount.cifs.c
> @@ -2145,7 +2145,7 @@ int main(int argc, char **argv)
>         int rc =3D 0;
>         int already_uppercased =3D 0;
>         int sloppy =3D 0;
> -       int fallback_sudo_uid =3D 0;
> +       int fallback_sudo_uid =3D geteuid() || getuid();
>         size_t options_size =3D MAX_OPTIONS_LEN;
>         struct parsed_mount_info *parsed_info =3D NULL;
>         struct parsed_mount_info *reinit_parsed_info =3D NULL;
> --
> 2.55.0
>


--=20
Thanks,

Steve