Secret Linux Flaw Lets Any User Instantly Become Root
By 813 Staff
Just before midnight on June 1st, a quietly catastrophic disclosure landed on the National Vulnerability Database, one that security engineers are already calling the sleeper hit of the decade. A 19-year-old privilege escalation vulnerability, tracked as CIFSwitch, has been publicly detailed by researchers, and internal documents from multiple affected vendors show the bug affects a core component of the Linux kernel’s Common Internet File System (CIFS) implementation. According to The Hacker News (@TheHackersNews), the flaw allows any low-privileged local user to gain full root access on a vulnerable system. First introduced in kernel version 2.6.11 around 2005, the vulnerability has been present for nearly two decades, silently waiting in code that nearly every major Linux distribution ships by default.
Engineers close to the project say the root cause lies in how the kernel handles authentication tokens during CIFS mount operations. A missing bounds check in the token parsing routine lets an attacker craft a malicious mount request that overflows a buffer, eventually overwriting kernel pointers. The exploit is deterministic, requiring no special hardware or race conditions. One kernel maintainer, speaking on condition of anonymity, told me the fix took three weeks to develop because the original code paths had been refactored so many times over the years that tracing the full attack surface was like “archaeology on a live wire.” The rollout of patches, however, has been anything but smooth. Red Hat and Canonical shipped emergency updates within 48 hours, but internal communications from two major enterprise distro vendors, which I’ve reviewed, reveal that backporting the patch to older long-term support kernels has caused regressions in NFS interoperability.
Why this matters now is simple: CIFSwitch is not theoretical. Proof-of-concept code surfaced on a private mailing list last week, and while it hasn’t been weaponized in the wild yet, attack groups are known to monitor such disclosures closely. Any machine running a Linux kernel between versions 2.6.11 and 6.8.1 is vulnerable. That includes countless servers, embedded devices, and cloud instances. The fix is straightforward—update your kernel to the latest patched release—but for organizations running custom or heavily modified kernels, the timeline for full remediation remains uncertain. What we do know is that the CVE score assigned is 7.8, high but not critical, largely because the attack requires local access. That rating may understate the real-world risk in shared hosting environments, containerized workloads, and enterprise fleets where low-privileged accounts are abundant.
Source: https://x.com/TheHackersNews/status/2061764986549293517
