CVE-2025-6019

Published Jun 19, 2025

Last updated a month ago

libblockdev

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-6019 is a local privilege escalation (LPE) vulnerability found in the libblockdev library. It can be exploited by accessing the udisks2 daemon, which manages storage devices, if an attacker gains the privileges of an active user (allow_active). This vulnerability exists because udisks mounts user-provided filesystem images with security flags to prevent privilege escalation. A local attacker can create a specially crafted XFS image containing a SUID-root shell and trick udisks into resizing it. This action mounts the malicious filesystem with root privileges, allowing the attacker to execute their SUID-root shell and gain complete control of the system. The vulnerability is triggered because the mount is performed without enforcing `nosuid` or `nodev` options.

Description: A Local Privilege Escalation (LPE) vulnerability was found in libblockdev. Generally, the "allow_active" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an "allow_active" user on a system may be able escalate to full root privileges on the target host. Normally, udisks mounts user-provided filesystem images with security flags like nosuid and nodev to prevent privilege escalation. However, a local attacker can create a specially crafted XFS image containing a SUID-root shell, then trick udisks into resizing it. This mounts their malicious filesystem with root privileges, allowing them to execute their SUID-root shell and gain complete control of the system.
Source: secalert@redhat.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7
Impact score: 5.9
Exploitability score: 1
Vector string: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

secalert@redhat.com: CWE-250

Hype score: Not currently trending

References