0xMarcio
4.2 KiB
CVE-2025-6019
Description
A Local Privilege Escalation (LPE) vulnerability was found in libblockdev. Generally, the "allow_active" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an "allow_active" user on a system may be able escalate to full root privileges on the target host. Normally, udisks mounts user-provided filesystem images with security flags like nosuid and nodev to prevent privilege escalation. However, a local attacker can create a specially crafted XFS image containing a SUID-root shell, then trick udisks into resizing it. This mounts their malicious filesystem with root privileges, allowing them to execute their SUID-root shell and gain complete control of the system.
POC
Reference
- https://cdn2.qualys.com/2025/06/17/suse15-pam-udisks-lpe.txt
- https://news.ycombinator.com/item?id=44325861
- https://www.bleepingcomputer.com/news/linux/new-linux-udisks-flaw-lets-attackers-get-root-on-major-linux-distros/
Github
- https://github.com/0xMarcio/cve
- https://github.com/And-oss/CVE-2025-6019-exploit
- https://github.com/B1ack4sh/Blackash-CVE-2025-6018
- https://github.com/JustThinkingHard/Annual-project
- https://github.com/JustThinkingHard/HID-Attack
- https://github.com/PuddinCat/GithubRepoSpider
- https://github.com/Threekiii/CVE
- https://github.com/dreysanox/CVE-2025-6018_Poc
- https://github.com/fkie-cad/nvd-json-data-feeds
- https://github.com/guinea-offensive-security/CVE-2025-6019
- https://github.com/harshitvarma05/CVE-2025-6019
- https://github.com/mistrust999/PAM-UDisks-PrivEsc-Metasploit
- https://github.com/mistrustt/PAM-UDisks-PrivEsc-Metasploit
- https://github.com/neko205-mx/CVE-2025-6019_Exploit
- https://github.com/nomi-sec/PoC-in-GitHub
- https://github.com/pawan-shivarkar/List-of-CVE-s-
- https://github.com/pawan-shivarkar/pawan-shivarkar
- https://github.com/plzheheplztrying/cve_monitor
- https://github.com/sultanovich/sultanovich-scripts-collection
- https://github.com/tanjiti/sec_profile