Qualys has discovered a vulnerability (CVE-2025-6019) in the libblockdev library, allowing manipulation of the background process udisks to gain root privileges on the system. A prototype exploit has been demonstrated on Ubuntu, Debian, Fedora, and openSUSE Leap 15.
The udisks process is used in almost all Linux distributions and provides a D-Bus interface for performing operations on storage devices, such as mounting and formatting. To perform actions on storage devices, udisks calls functions from the libblockdev library. Access to udisks is by default open only to users operating in the 'allow_active' context, meaning those with physical access to the computer and who have logged in through a local console or launched a graphical session. Users connecting remotely, for example via SSH, do not fall into this context and cannot directly exploit the vulnerability.
To bypass this restriction, a trick can be used to elevate the authentication level to 'allow_active' by manipulating the launch of a user service with the systemctl utility, which polkitd will interpret as a sign of a local session. The essence of the method is that polkitd determines the presence of physical access and assigns the 'allow_active' level based on indirect signs that can be influenced. The limitation of this method is that for polkitd to be fooled, a local user session with physical access must already be active on the system.
The second method to obtain 'allow_active' privileges is by exploiting a vulnerability (CVE-2025-6018) in PAM (Pluggable Authentication Modules), which researchers from Qualys identified during their analysis of the vulnerability in libblockdev. This vulnerability allows any user, including those connecting via SSH, to perform operations in the context of 'allow_active'. The issue is specific to the PAM configurations in openSUSE Leap 15 and SUSE Linux Enterprise 15 and occurs only in these distributions.
In the pam_env module in openSUSE and SUSE, reading the file ~/.pam_environment is enabled by default. Through this file, a user can set the environment variables XDG_SEAT=seat0 and XDG_VTNR=1, which will be recognized during further processing as an indication of the user's physical presence, even if the login was actually done via SSH. The pam_env module is also invoked when connecting via SSH in Debian 12 and Ubuntu 24.04 (it is disabled in Debian 13 and Ubuntu 24.10+), but setting environment variables in these distributions cannot be used to elevate access to 'allow_active' since pam_env is called at the final stage after loading the pam_systemd module, and the set environment variables cannot influence the session parameters.
Regarding the vulnerability in libblockdev, an attacker can mount an image of an arbitrary filesystem in loop mode by placing an executable file with the SUID root flag or a special device (/dev/mem) for low-level access to disks or memory in this image. To block such attacks, filesystem images are mounted by the system with the nosuid and nodev flags, but the vulnerability in libblockdev allows mounting images without the nosuid and nodev flags. The essence of the vulnerability is that udisks allows a user with 'allow_active' access level to resize their filesystems, and libblockdev temporarily mounts the filesystem during this operation without setting the nosuid and nodev flags.
Thus, the attack boils down to creating a loop device based on the XFS filesystem image that contains a SUID root file, initiating the operation to resize the loop device, and monitoring the moment it is mounted in the /tmp/blockdev* directory: victim> killall -KILL gvfs-udisks2-volume-monitor victim> udisksctl loop-setup --file ./xfs.image --no-user-interaction Mapped file ./xfs.image as /dev/loop0. victim> while true; do /tmp/blockdev*/bash -c 'sleep 10; ls -l /tmp/blockdev*/bash' && break; done 2>/dev/null & victim> gdbus call --system --dest org.freedesktop.UDisks2 --object-path /org/freedesktop/UDisks2/block_devices/loop0 --method org.freedesktop.UDisks2.Filesystem.Resize 0 '{}' Error: GDBus.Error:org.freedesktop.UDisks2.Error.Failed: Error resizing filesystem on /dev/loop0: Failed to unmount '/dev/loop0' after resizing it: target is busy -r-sr-xr-x. 1 root root 1406608 Jun 18 09:42 /tmp/blockdev.RSM429/bash victim> /tmp/blockdev*/bash -p victim# id uid=65534(nobody) gid=65534(nobody) euid=0(root) groups=65534(nobody)
The vulnerability in libblockdev has only been addressed in the form of patches. You can check the status of the new package version or the preparation of a fix in the distributions on the following pages (if the page is unavailable, it means the distribution developers have not yet begun addressing the issue): Debian, Ubuntu, Fedora, SUSE/openSUSE, RHEL, Gentoo, and Arch (1, 2). As a workaround to block the vulnerability, you can change the access rule for the operation "org.freedesktop.udisks2.modify-device" in polkit by modifying the parameter value "allow_active" from "yes" to "auth_admin" in the file /usr/share/polkit-1/actions/org.freedesktop.UDisks2.policy.
Additionally, a vulnerability (CVE-2025-6020) in the linux-pam package, disclosed a few hours ago, allows a local user to gain root privileges. The pam_namespace module did not properly validate user-controlled file paths, allowing for manipulation of symbolic links and achieving a race condition that led to the overwrite of privileged files in the system. The vulnerability has been fixed in the linux-pam 1.7.1 release. You can check the status of the new package version or the preparation of a fix in the distributions on the following pages: Debian, Ubuntu, Fedora, SUSE/openSUSE, RHEL, Gentoo, and Arch (1, 2).
Source: opennet.ru
