Affected: AlmaLinux:9: libblockdev, AlmaLinux:9: libblockdev-crypto, AlmaLinux:9: libblockdev-dm, AlmaLinux:9: libblockdev-fs, AlmaLinux:9: libblockdev-kbd, AlmaLinux:9: libblockdev-loop, AlmaLinux:9: libblockdev-lvm, AlmaLinux:9: libblockdev-lvm-dbus, AlmaLinux:9: libblockdev-mdraid, AlmaLinux:9: libblockdev-mpath and 9 more

The libblockdev packages provide a C library with GObject introspection support used for low-level operations on block devices. The library serves as a thin wrapper around plug-ins for specific functionality, such as LVM, Btrfs, LUKS, or MD RAID.

Security Fix(es):

* libblockdev: LPE from allow_active to root in libblockdev via udisks (CVE-2025-6019)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A Local Privilege Escalation (LPE) vulnerability was found in libblockdev. Generally, the "allow_active" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an "allow_active" user on a system may be able escalate to full root privileges on the target host. Normally, udisks mounts user-provided filesystem images with security flags like nosuid and nodev to prevent privilege escalation. However, a local attacker can create a specially crafted XFS image containing a SUID-root shell, then trick udisks into resizing it. This mounts their malicious filesystem with root privileges, allowing them to execute their SUID-root shell and gain complete control of the system.

A Local Privilege Escalation (LPE) vulnerability was found in libblockdev. Generally, the "allow_active" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an "allow_active" user on a system may be able escalate to full root privileges on the target host. Normally, udisks mounts user-provided filesystem images with security flags like nosuid and nodev to prevent privilege escalation. However, a local attacker can create a specially crafted XFS image containing a SUID-root shell, then trick udisks into resizing it. This mounts their malicious filesystem with root privileges, allowing them to execute their SUID-root shell and gain complete control of the system.

Affected: openEuler:22.03-LTS-SP4: libblockdev, openEuler:24.03-LTS: libblockdev, openEuler:24.03-LTS-SP1: libblockdev, openEuler:20.03-LTS-SP4: libblockdev, openEuler:22.03-LTS-SP3: libblockdev

libblockdev is a C library supporting GObject introspection for manipulation of block devices. It has a plugin-based architecture where each technology (like LVM, Btrfs, MD RAID, Swap,...) is implemented in a separate plugin, possibly with multiple implementations (e.g. using LVM CLI or the new LVM DBus API). Security Fix(es):

A Local Privilege Escalation (LPE) vulnerability was found in libblockdev. Generally, the "allow_active" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an "allow_active" user on a system may be able escalate to full root privileges on the target host. Normally, udisks mounts user-provided filesystem images with security flags like nosuid and nodev to prevent privilege escalation. However, a local attacker can create a specially crafted XFS image containing a SUID-root shell, then trick udisks into resizing it. This mounts their malicious filesystem with root privileges, allowing them to execute their SUID-root shell and gain complete control of the system.(CVE-2025-6019)

libbd_btrfs-devel-3.1.1-2.1 on GA media

libblockdev: LPE from allow_active to root in libblockdev via udisks

Security update for libblockdev

Affected: Ubuntu:Pro:18.04:LTS: libblockdev, Ubuntu:Pro:18.04:LTS: udisks2, Ubuntu:Pro:20.04:LTS: libblockdev, Ubuntu:Pro:20.04:LTS: udisks2, Ubuntu:22.04:LTS: libblockdev, Ubuntu:22.04:LTS: udisks2, Ubuntu:24.04:LTS: libblockdev, Ubuntu:24.04:LTS: udisks2, Ubuntu:25.10: udisks2

A Local Privilege Escalation (LPE) vulnerability was found in libblockdev. Generally, the "allow_active" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an "allow_active" user on a system may be able escalate to full root privileges on the target host. Normally, udisks mounts user-provided filesystem images with security flags like nosuid and nodev to prevent privilege escalation. However, a local attacker can create a specially crafted XFS image containing a SUID-root shell, then trick udisks into resizing it. This mounts their malicious filesystem with root privileges, allowing them to execute their SUID-root shell and gain complete control of the system.

Ein lokaler Angreifer kann mehrere Schwachstellen in verschiedenen Linux Distributionen ausnutzen, um seine Privilegien zu erhöhen.