Libblockdev: lpe from allow_active to root in libblockdev via udisks

Summary

A Local Privilege Escalation (LPE) vulnerability was found in libblockdev. Generally, the "allow_active" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an "allow_active" user on a system may be able escalate to full root privileges on the target host. Normally, udisks mounts user-provided filesystem images with security flags like nosuid and nodev to prevent privilege escalation. However, a local attacker can create a specially crafted XFS image containing a SUID-root shell, then trick udisks into resizing it. This mounts their malicious filesystem with root privileges, allowing them to execute their SUID-root shell and gain complete control of the system.

Timeline

1. Jun 19, 2025, 11:55 AM UTCCVE published
2. Jun 24, 2025, 3:55 AM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Jun 30, 2026, 11:10 AM UTCRecord last updated

Affected versions

• libblockdev

  fixed in 3.3.1

• libblockdev

  Version range not reported

• libblockdev

  Version range not reported

• libblockdev

  Version range not reported

• libblockdev

  Version range not reported

• libblockdev

  Version range not reported

• libblockdev

  Version range not reported

• libblockdev

  Version range not reported

• libblockdev

  Version range not reported

• libblockdev

  Version range not reported

• libblockdev

  Version range not reported

• libblockdev

  Version range not reported

• libblockdev

  Version range not reported

• libblockdev

  Version range not reported

References 25