« Volver al listado

CVE-2025-2312

Estado: AplazadaMedia (5.9)—

A flaw was found in cifs-utils. When trying to obtain Kerberos credentials, the cifs.upcall program from the cifs-utils package makes an upcall to the wrong namespace in containerized environments. This issue may lead to disclosing sensitive data from the host's Kerberos credentials cache.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Cifs-utils — Cifs-utilsAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-2312",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-2312",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-03-25T18:22:51.623724Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "74b3a70d-cca6-4d34-9789-e83b222ae3be",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.9,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4,
        "exploitabilityScore": 1.4
      }
    ]
  },
  "affected": [
    {
      "source": "74b3a70d-cca6-4d34-9789-e83b222ae3be",
      "affectedData": [
        {
          "vendor": "cifs-utils",
          "product": "cifs-utils",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "7.2",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-03-25T18:15:34.987",
  "references": [
    {
      "url": "https://git.samba.org/?p=cifs-utils.git;a=commit;h=89b679228cc1be9739d54203d28289b03352c174",
      "source": "74b3a70d-cca6-4d34-9789-e83b222ae3be"
    },
    {
      "url": "https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/fs/smb?id=db363b0a1d9e6b9dc556296f1b1007aeb496a8cf",
      "source": "74b3a70d-cca6-4d34-9789-e83b222ae3be"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "74b3a70d-cca6-4d34-9789-e83b222ae3be",
      "description": [
        {
          "lang": "en",
          "value": "CWE-488"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in cifs-utils. When trying to obtain Kerberos credentials, the cifs.upcall program from the cifs-utils package makes an upcall to the wrong namespace in containerized environments. This issue may lead to disclosing sensitive data from the host's Kerberos credentials cache."
    },
    {
      "lang": "es",
      "value": "Se detectó una falla en cifs-utils. Al intentar obtener credenciales Kerberos, el programa cifs.upcall del paquete cifs-utils realiza una llamada ascendente al espacio de nombres incorrecto en entornos contenedorizados. Este problema puede provocar la divulgación de datos confidenciales de la caché de credenciales Kerberos del host."
    }
  ],
  "lastModified": "2026-06-17T09:06:44.313",
  "sourceIdentifier": "74b3a70d-cca6-4d34-9789-e83b222ae3be"
}