Cybersecurity Announcement: Linux Kernel Privilege Escalation to Root Vulnerability - CIFSwitch
This document is the cybersecurity announcement for the CIFSwitch Linux LPE vulnerability.
About the Event
CIFSwitch is a Linux LPE vulnerability which targets the Common Internet File System (CIFS) kernel module in Linux.
Actions to Consider
This attack is similar to Copy-Fail. As it is a consistent Local Privilege Escalation (LPE), no race condition is necessary. Cybersecurity recommends Linux administrators evaluate their risks and apply the backported kernel patch during their next patching cycle. There are also migitation instructions included in the articles linked in the References section.
If you believe you may have been compromised please contact the Office of Cybersecurity at cybersecurity@cio.wisc.edu.
Event Impact
Any local unprivileged user would be able to obtain root-level access resulting in a full system takeover. Proof of concept code is already publicly available. The CIFS module may be enabled or disabled by default depending on your distro. Please see
https://heyitsas.im/posts/cifswitch/#distro-impact-tables to view affected distributions.
References