libblockdev udisks unnecessary privileges

Summaryinfo

A vulnerability marked as critical has been reported in libblockdev. This impacts an unknown function of the component udisks. The manipulation leads to Local Privilege Escalation. This vulnerability is uniquely identified as CVE-2025-6019. Local access is required to approach this attack. No exploit exists.

Detailsinfo

A vulnerability was found in libblockdev (the affected version is unknown) and classified as critical. This issue affects an unknown code of the component udisks. The manipulation with an unknown input leads to a local privilege escalation vulnerability. Using CWE to declare the problem leads to CWE-250. The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A Local Privilege Escalation (LPE) vulnerability was found in libblockdev. Generally, the "allow_active" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an "allow_active" user on a system may be able escalate to full root privileges on the target host. Normally, udisks mounts user-provided filesystem images with security flags like nosuid and nodev to prevent privilege escalation. However, a local attacker can create a specially crafted XFS image containing a SUID-root shell, then trick udisks into resizing it. This mounts their malicious filesystem with root privileges, allowing them to execute their SUID-root shell and gain complete control of the system.

It is possible to read the advisory at bugzilla.redhat.com. The identification of this vulnerability is CVE-2025-6019 since 06/11/2025. The exploitation is known to be easy. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/09/2025). The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 240149 (Debian dsa-5943 : gir1.2-blockdev-2.0 - security update), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Tenable (240149), EUVD (EUVD-2025-18685) and CERT Bund (WID-SEC-2025-1354). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• Gentoo Linux
• Open Source Arch Linux
• SUSE openSUSE

Productinfo

Name

• libblockdev

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion