CVE-2025-2312

What it actually does

In containerized environments, the cifs.upcall program from cifs-utils makes an upcall to the wrong namespace when obtaining Kerberos credentials, resulting in disclosure of sensitive data from the host's Kerberos credentials cache.

Why it matters to the business

Organizations running containerized workloads that rely on network file shares face risk of leaked authentication secrets, potentially enabling unauthorized access and increasing exposure in environments with high downstream package usage.

How an attack unfolds

An attacker with access inside a container triggers cifs.upcall to fetch Kerberos credentials; due to the namespace misdirection, the call reaches the host cache instead, allowing the attacker to read and exfiltrate the host's sensitive Kerberos tickets. Threat actor references to related Linux kernel privilege escalations indicate potential chaining in broader campaigns.

How to fix it

Upgrade affected packages to the fixed versions: python-django to 0:1.11.11-1.el7ost, python-django-bash-completion to 0:1.11.11-1.el7ost, and python2-django to 0:1.11.11-1.el7ost on Red Hat OpenStack 13 EL7 systems. Apply updates immediately given the published date and ecosystem prevalence.

How to confirm the fix worked

Verify package versions match the fixed releases listed for each product; test containerized cifs operations to confirm upcalls remain isolated to the expected namespace and do not surface host credentials.

Typical attack path

1. Obtain code execution or shell access inside a container sharing the host's cifs-utils stack
2. Trigger or invoke cifs.upcall to request Kerberos credentials
3. Exploit the namespace confusion to read the host Kerberos credentials cache
4. Exfiltrate captured credentials for further authentication or lateral movement

How to detect it

Search system and container logs for cifs.upcall invocations that cross namespace boundaries; monitor for unexpected reads of host Kerberos credential cache files or processes accessing /tmp/krb5cc_* from within containers.

What your security team should do

• Prioritize patching all listed Red Hat OpenStack packages within the next 30 days due to publication age and potential chaining with kernel escalations
• Audit container configurations to ensure cifs-utils upcalls are properly namespaced
• Review and restrict access to any shared Kerberos credential caches between host and containers