CVE-2025-2312CWE-488

cifs.upcall makes an upcall to the wrong namespace in containerized environments

Medium · published March 25, 2025

CVSS v3.1
5.9
EPSS
0%
Percentile
11.1
In the wild
Unconfirmed
What it is

A flaw was found in cifs-utils. When trying to obtain Kerberos credentials, the cifs.upcall program from the cifs-utils package makes an upcall to the wrong namespace in containerized environments. This issue may lead to disclosing sensitive data from the host's Kerberos credentials cache.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00213 · 11.1th percentile
Weakness
CWE-488 · Exposure of Data Element to Wrong Session
Published
2025-03-25T18:08Z
EPSS history
Timeline
  • 25 MAR 18:08Z
    cifs.upcall makes an upcall to the wrong namespace in containerized environments
    cvelistv5