Linux Local Privilege Escalation via udisksd and libblockdev (CVE-2025-6019) PoC released
Summary : A local privilege escalation vulnerability poc has been released, tracked as CVE-2025-6019, discovered in the udisksd daemon and its backend libblockdev library, affecting widely used Linux distributions including Fedora and SUSE.
| Severity | High |
| CVSS Score | 7.0 |
| CVEs | CVE-2025-6019 |
| POC Available | Yes |
| Actively Exploited | No |
| Exploited in Wild | No |
| Advisory Version | 1.0 |
Overview
CVE-2025-6019 is a local privilege escalation (LPE) vulnerability affecting systems where:
- udisksd is installed and running (e.g., Fedora, SUSE)
- Users in the allow active group are trusted to execute disk-related actions
- libblockdev fails to validate privileged backend operations under unprivileged contexts
This flaw allows unprivileged users in the “allow_active” group to escalate privileges and execute commands as root by exploiting insecure trust boundaries in D-Bus IPC communication.
| Vulnerability Name | CVE ID | Product Affected | Severity |
| Local Privilege Escalation Vulnerability | CVE-2025-6019 | udisksd / libblockdev | High |
Technical Summary
This vulnerability is triggered when an attacker in the “allow_active” group issues a crafted D-Bus request to the udisksd daemon using tools like udisksctl. Because the daemon improperly relies on group membership alone (without UID validation), it mistakenly grants root-level mount permissions.
An attacker can exploit this by
- Crafting a malicious disk image (like XFS with a SUID-root shell).
- Using “udisksctl mount -b /dev/loop0” to mount it as root.
- Escalating privileges and compromising the system.
| CVE ID | System Affected | Vulnerability Details | Impact |
| CVE-2025-6019 | Fedora, SUSE, and other Linux distros using udisks2/libblockdev | Improper user validation in D-Bus authorization allows unprivileged users to perform privileged disk operations. | Local privilege escalation to root |
Remediation:
Here are the recommendations below
- Update “udisks2” and “libblockdev” to the latest versions provided by your distribution.
- Audit and restrict membership of the “allow_active” group.
- Disable unsafe or legacy D-Bus actions in system services where possible.
Conclusion:
CVE-2025-6019 highlights a breakdown in privilege boundary enforcement within a core system component used by many Linux desktop environments.
The availability of a public PoC, combined with the low complexity of exploitation, makes this vulnerability highly dangerous, particularly in multi-user or shared computing environments.
Organizations must act swiftly to patch vulnerable systems, reassess group-based privilege models and implement stricter D-Bus and Polkit rules to reduce attack surface.
References:
Recent Comments