{"id":"CVE-2025-6019","summary":"Libblockdev: lpe from allow_active to root in libblockdev via udisks","details":"A Local Privilege Escalation (LPE) vulnerability was found in libblockdev. Generally, the \"allow_active\" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an \"allow_active\" user on a system may be able escalate to full root privileges on the target host. Normally, udisks mounts user-provided filesystem images with security flags like nosuid and nodev to prevent privilege escalation.  However, a local attacker can create a specially crafted XFS image containing a SUID-root shell, then trick udisks into resizing it. This mounts their malicious filesystem with root privileges, allowing them to execute their SUID-root shell and gain complete control of the system.","modified":"2026-08-12T03:51:38.853044914Z","published":"2025-06-19T11:55:57.380Z","related":["ALSA-2025:9327","ALSA-2025:9328","ALSA-2025:9878","ALSA-2025:A004","ALSA-2025:A005","ALSA-2025:A006","SUSE-SU-2025:02043-1","SUSE-SU-2025:02044-1","SUSE-SU-2025:20426-1","SUSE-SU-2025:20440-1","openSUSE-SU-2025:15237-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/6xxx/CVE-2025-6019.json","cna_assigner":"redhat","cwe_ids":["CWE-250"]},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2025/06/17/5"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2025/06/17/6"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2025/06/18/1"},{"type":"WEB","url":"https://access.redhat.com/downloads/content/package-browser/"},{"type":"WEB","url":"https://cdn2.qualys.com/2025/06/17/suse15-pam-udisks-lpe.txt"},{"type":"WEB","url":"https://github.com/storaged-project/libblockdev/"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/06/msg00018.html"},{"type":"WEB","url":"https://news.ycombinator.com/item?id=44325861"},{"type":"WEB","url":"https://www.bleepingcomputer.com/news/linux/new-linux-udisks-flaw-lets-attackers-get-root-on-major-linux-distros/"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2025:10796"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2025:9320"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2025:9321"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2025:9322"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2025:9323"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2025:9324"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2025:9325"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2025:9326"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2025:9327"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2025:9328"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2025:9878"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2025-6019"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/6xxx/CVE-2025-6019.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-6019"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2370051"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/storaged-project/libblockdev","events":[{"introduced":"0"},{"fixed":"221811eb8695c336b3e31911ebfb3a3a690aa090"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"3.3.1"}],"source":"AFFECTED_FIELD"}}],"versions":["3.3.0","3.2.0","3.1.0-1","3.0.4-1","3.0.3-1","3.0.2-1","3.0.1-1","3.0-1","2.23-1","2.22-1","2.21-1","2.20-1","2.19-1","2.18-1","2.17-1","2.16-1","2.15-1","2.14-1","2.13-1","libblockdev-2.12-1","2.12-1","libblockdev-2.11-1","2.11-1","libblockdev-2.10-1","2.10-1","libblockdev-2.9-1","2.9-1","libblockdev-2.8-1","2.8-1","libblockdev-2.7-1","2.7-1","libblockdev-2.6-1","2.6-1","libblockdev-2.4-1","2.4-1","libblockdev-2.5-1","2.5-1","libblockdev-2.3-1","2.3-1","libblockdev-2.2-1","2.2-1","libblockdev-2.1-1","2.1-1","libblockdev-2.0-1","2.0-1","libblockdev-1.5-1","1.5-1","libblockdev-1.4-1","1.4-1","libblockdev-1.3-1","1.3-1","libblockdev-1.2-1","1.2-1","libblockdev-1.1-1","1.1-1","libblockdev-1.0-1","1.0-1","libblockdev-0.13-1","0.13-1","libblockdev-0.11-1","0.11-1","libblockdev-0.10-1","0.10-1","libblockdev-0.8-1","0.8-1","libblockdev-0.7-1","0.7-1","libblockdev-0.6-1","0.6-1","libblockdev-0.5-1","0.5-1","libblockdev-0.4-1","0.4-1","libblockdev-0.3-1","0.3-1","libblockdev-0.2-1","0.2-1","libblockdev-0.1-1","0.1-1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-6019.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}