Qualys has discovered a vulnerability (CVE-2025-6019) in the libblockdev library, allowing manipulation of the background process udisks to gain root privileges on the system. A prototype exploit has been demonstrated on Ubuntu, Debian, Fedora, and openSUSE Leap 15. <\/p>\n
The udisks process is used in almost all Linux distributions and provides a D-Bus interface for performing operations on storage devices, such as mounting and formatting. To perform actions on storage devices, udisks calls functions from the libblockdev library. By default, access to udisks is only available to users operating within the 'allow_active' context, meaning they have physical access to the computer and are connected through the local console or have started a graphical session. Users connecting remotely, such as via ssh, do not fall into this context and cannot exploit the vulnerability directly. <\/p>\n
To bypass this limitation, a trick can be used that raises the authentication level to 'allow_active' through manipulation of the user service startup via the systemctl utility, which polkitd will perceive as a sign of a local session. The essence of the method is that polkitd determines physical access and assigns the 'allow_active' level based on indirect indicators that can be influenced. The limitation of this method is that to deceive polkitd, a local user session with physical access must already be active on the system. <\/p>\n
The second method of obtaining 'allow_active' privileges is to exploit a vulnerability (CVE-2025-6018) in PAM (Pluggable Authentication Modules), which researchers from Qualys discovered during their analysis of the vulnerability in libblockdev. This vulnerability allows any user, including those connecting via SSH, to perform operations in the 'allow_active' context. The issue is specific to PAM configurations in openSUSE Leap 15 and SUSE Linux Enterprise 15, and it only manifests in these distributions. <\/p>\n
In the pam_env module in openSUSE and SUSE, reading the file ~\/.pam_environment is enabled by default. Through this file, a user can set the environment variables XDG_SEAT=seat0 and XDG_VTNR=1, which will be recognized in further processing as an indication of the user's physical presence, even if the login was actually done via SSH. The pam_env module is also invoked when connecting via SSH in Debian 12 and Ubuntu 24.04 (it is disabled in Debian 13 and Ubuntu 24.10+), but setting environment variables in these distributions cannot elevate access to 'allow_active', as pam_env is invoked at the final stage after loading the pam_systemd module, and the set environment variables cannot affect session parameters. <\/p>\n
Regarding the vulnerability in libblockdev, an attacker can mount an arbitrary filesystem image in loop mode by placing an executable file with the SUID root flag or a special device (\/dev\/mem) for low-level access to disks or memory in this image. To prevent such attacks, filesystem images are mounted by the system with the nosuid and nodev flags, but the vulnerability in libblockdev allows mounting an image without the nosuid and nodev flags. The essence of the vulnerability is that udisks allows a user with 'allow_active' access level to resize their filesystems, and during this operation, libblockdev temporarily mounts the filesystem without setting the nosuid and nodev flags. <\/p>\n
Thus, the attack boils down to creating a loop device based on an XFS filesystem image containing a suid root file, initiating the resizing operation of the loop device, and monitoring the moment it is mounted to \/tmp\/blockdev*: victim> killall -KILL gvfs-udisks2-volume-monitor victim> udisksctl loop-setup \u2014file .\/xfs.image \u2014no-user-interaction Mapped file .\/xfs.image as \/dev\/loop0. victim> while true; do \/tmp\/blockdev*\/bash -c 'sleep 10; ls -l \/tmp\/blockdev*\/bash' && break; done 2>\/dev\/null & victim> gdbus call \u2014system \u2014dest org.freedesktop.UDisks2 \u2014object-path \/org\/freedesktop\/UDisks2\/block_devices\/loop0 \u2014method org.freedesktop.UDisks2.Filesystem.Resize 0 '{}' Error: GDBus.Error:org.freedesktop.UDisks2.Error.Failed: Error resizing filesystem on \/dev\/loop0: Failed to unmount '\/dev\/loop0' after resizing it: target is busy -r-sr-xr-x. 1 root root 1406608 Jun 18 09:42 \/tmp\/blockdev.RSM429\/bash victim> \/tmp\/blockdev*\/bash -p victim# id uid=65534(nobody) gid=65534(nobody) euid=0(root) groups=65534(nobody) <\/p>\n
The vulnerability in libblockdev has only been resolved in the form of patches. You can check the status of the new version of the package or the preparation of fixes in the distributions on the following pages (if the page is unavailable, it means the distribution developers have not yet started addressing the issue): Debian, Ubuntu, Fedora, SUSE\/openSUSE, RHEL, Gentoo, and Arch (1, 2). As a workaround to block the vulnerability, you can modify the access rule for the operation «org.freedesktop.udisks2.modify-device» in polkit by changing the «allow_active» parameter value from «yes» to «auth_admin» in the file \/usr\/share\/polkit-1\/actions\/org.freedesktop.UDisks2.policy. <\/p>\n