CVE-2025-6019 PoC

Simple proof-of-concept for a UDisks2 XFS resize privilege escalation.

Files

• create_payload.sh: Builds an XFS image with a SUID rootbash payload.
• exploit.sh: Triggers the resize path and launches the SUID shell.

Requirements

• mkfs.xfs, udisksctl, gdbus, loginctl
• An allow_active Polkit session (for example, a physical console login or one obtained through another vulnerability such as CVE-2025-6018)
• A crafted XFS filesystem image generated by create_payload.sh

Usage

1. Create the payload image:

./create_payload.sh

2. Move the image to the target, then run the exploit:

./exploit.sh exploit /path/to/payload.img