robbin0919/cve-2025-6019
CVE-2025-6019 is a local privilege escalation (LPE) vulnerability discovered in the libblockdev library, which interacts with the udisks2 daemon and Polkit.
A local attacker with allow_active Polkit privileges (typically a user physically in front of the computer) can exploit the way libblockdev interacts with the udisks daemon. The attacker can craft a malicious XFS image containing a SUID-root shell and trick udisks into mounting the image without security flags such as nosuid and nodev. This allows the attacker to execute the SUID-root shell and gain full root privileges on the system.
The entire attack flow can be divided into three stages: preparation, transmission, and trigger. The malicious image can be pre-prepared on any system.
Preparation Stage (on the attacker's own machine): The attacker uses standard Linux tools (e.g., mkfs.xfs) to create an image of an XFS filesystem. Inside this image, they place a pre-compiled malicious program with SUID permissions (e.g., a backdoor shell). The image itself is an "attack payload (payload)."
Transmission Stage: The attacker needs to transfer the crafted malicious image to the target host. There are many methods, such as downloading via wget, using a USB drive, or exploiting other vulnerabilities on the target host to upload the file.
Trigger Stage (on the target host): The core step of the attack occurs on the target host. The attacker exploits CVE-2025-6019 to trick the udisks2 service on the target host into mounting this malicious image. Due to the vulnerability, udisks2 does not apply necessary security flags (such as nosuid) when mounting.
Privilege Escalation Stage: Once the image is mounted unsafely, the malicious program with SUID permissions inside becomes executable, and when executed, it inherits root privileges, allowing the attacker to succeed.
Conclusion: The image is merely a 'container' carrying a malicious program; where it is created does not matter. What matters is how the target system 'processes' this container.
The CVSS 3.1 base score for this vulnerability is 7.0, which is high severity.
Successful exploitation of this vulnerability could lead to an attacker gaining full control of the affected system.
Most Linux distributions using libblockdev and the udisks2 service are affected, including Ubuntu, Debian, Fedora, and openSUSE.
allow_active setting of the polkit rule org.freedesktop.udisks2.modify-device from yes to auth_admin.This vulnerability may sometimes be used in conjunction with another vulnerability, CVE-2025-6018, which in some distributions can be used to remotely obtain allow_active privileges.
This vulnerability also highlights how Linux bugs can affect software-defined vehicles using Automotive Grade Linux (AGL).