https://cdn2.qualys.com/2025/06/17/suse15-pam-udisks-lpe.txt

This exploit chains CVE-2025-6018 and CVE-2025-6019 to achieve local privilege escalation from an unprivileged user to root on vulnerable SUSE/openSUSE systems. CVE-2025-6018 is a PAM (Pluggable Authentication Modules) environment variable injection vulnerability in pam_env.so (versions 1.3.0-1.6.0) that allows users to poison their session environment via ~/.pam_environment using the OVERRIDE directive. By manipulating XDG session variables (XDG_SEAT, XDG_VTNR, XDG_SESSION_TYPE), an attacker can trick systemd-logind into granting allow_active PolicyKit privileges, making the remote SSH session appear as a local physical session. Once allow_active status is obtained, CVE-2025-6019 can be exploited: this vulnerability in UDisks2/libblockdev allows users with allow_active permissions to mount filesystems with privileged options (exec, suid) through a race condition in the Filesystem.Resize D-Bus method. When a resize operation is triggered on a loop device containing a crafted XFS filesystem with a SUID root bash binary, libblockdev automatically mounts the filesystem to perform the resize, but fails to unmount it due to the resize error, leaving the SUID bash accessible in /tmp/blockdev*/, which can then be executed to obtain a root shell.

Detailed Steps

STAGE 1: Create XFS Image (Attacker/Kali)

sudo ./ExploitChain.sh stage1 [output_path]
# Default: ./xfs.image
# Creates 300MB XFS filesystem with SUID root bash

Transfer Image to Target

scp xfs.image user@<target_ip>:/tmp/

STAGE 2: PAM Injection (Target)

./ExploitChain.sh stage2
# Creates ~/.pam_environment with malicious XDG variables
# MUST logout and login to trigger PAM processing

Logout and Re-authenticate

logout
ssh user@<target_ip>
# PAM processes ~/.pam_environment on login
# systemd-logind grants allow_active status

STAGE 3: UDisks2 Exploit (Target)

./ExploitChain.sh stage3 /tmp/xfs.image
# Exploits UDisks2 Filesystem.Resize bug
# Mounts XFS image with SUID bash
# Spawns root shell

Automatic Mode

# On Kali (auto-detects root and runs stage1)
sudo ./Exploit-6018-Chain-6019-v3.sh auto

# On target (auto-detects stage and runs stage2/stage3)
./ExploitChain.sh auto /tmp/xfs.image

Help

./ExploitChain.sh help

Exploit-Chain-CVE-2025-6018-6019

Most Popular