My employer is interested in seeing cifs-utils CVE-2025-2312
(cifs.upcall program from the cifs-utils package makes an upcall to the
wrong namespace in containerized environments) fixed in bookworm. [1] According to the tracker, the fix depends on a kernel change in addition
to the cifs-utils userspace fix [2, 3].
The kernel change doesn't appear to have been backported to any of the kernel.org LTS trees, so I've suggested that the people responsible for implementation of that change should also work to backport it there.
Without this, it seems that even trixie will be vulnerable.
I don't believe that this issue warrants a DSA, or that it should be considered RC for trixie. If we publish a fix, it should be by way of a point release containing a kernel that includes the upstream change and
an updated cifs-utils package. Do the maintainers involved agree?
In the event that upstream is unwilling to apply this change to the
kernel LTS trees, would the kernel team consider carrying it as a local patch?
Speaking for the kernel-team: No, if we want that change in stable and
for the 6.1.y kernel then it should be accepted upstream in the 6.1.y
series. As alternative your employer might use backports kernel?
On Tue, Apr 22, 2025 at 07:58:56PM +0200, Salvatore Bonaccorso wrote:
Speaking for the kernel-team: No, if we want that change in stable and
for the 6.1.y kernel then it should be accepted upstream in the 6.1.y series. As alternative your employer might use backports kernel?
The kernel change was introduced with 6.13, so backports doesn't help
yet. I'll work with my employer's kernel folkѕ on getting the kernel
change applied to the 6.x LTS branches, and will revisit this with the cifs-utils maintainers once it's available there.
Hi Noah,
On Tue, Apr 22, 2025 at 02:16:04PM -0400, Noah Meyerhans wrote:
On Tue, Apr 22, 2025 at 07:58:56PM +0200, Salvatore Bonaccorso wrote:
Speaking for the kernel-team: No, if we want that change in stable and for the 6.1.y kernel then it should be accepted upstream in the 6.1.y series. As alternative your employer might use backports kernel?
The kernel change was introduced with 6.13, so backports doesn't help
yet. I'll work with my employer's kernel folkѕ on getting the kernel change applied to the 6.x LTS branches, and will revisit this with the cifs-utils maintainers once it's available there.
Just for clarity, yes I know, the target kernel for trixie will be
6.12.y based, what i meant is once we have backports there. Sorry that
I was not clear about it.
| Sysop: | Keyop |
|---|---|
| Location: | Huddersfield, West Yorkshire, UK |
| Users: | 546 |
| Nodes: | 16 (3 / 13) |
| Uptime: | 06:39:20 |
| Calls: | 10,388 |
| Calls today: | 3 |
| Files: | 14,061 |
| Messages: | 6,416,816 |
| Posted today: | 1 |