libblockdev: Local Privilege Escalation in libblockdev via Polkit/udisks allow_active (CVE-2025-6019) #shorts

Summary

In today’s episode we look at CVE-2025-6019, a local privilege escalation vulnerability in libblockdev that affects most major Linux distributions. Discovered and published in June 2025, this flaw allows an unprivileged, physically present user to escalate to full root privileges by abusing the way libblockdev interacts with the udisks daemon and Polkit’s allow_active setting. We’ll also touch on how this vulnerability can be chained with CVE-2025-6018 to create a powerful attack vector.

Product details

CVE-2025-6019 impacts libblockdev libraries on multiple Red Hat Enterprise Linux versions, including RHEL 7, 8, 9, and 10. The vulnerability stems from the default Polkit policy that grants active session users permission to perform certain actions via udisks. When a user has an allow_active session, they can request filesystem operations without additional authentication.

Vulnerability type summary

This is classified as an Execution with Unnecessary Privileges flaw, specifically a Local Privilege Escalation (LPE). The root cause lies in excessive trust in user-provided filesystem images combined with insufficient mount security flags, which together enable an attacker to execute code as root.

Details of the vulnerability

Under normal operation, udisks mounts user-supplied filesystem images with restrictive flags such as nosuid and nodev to prevent escalation. However, an attacker can craft a malicious XFS image containing a SUID-root shell. By invoking a resize operation through libblockdev and udisks—granted by Polkit’s allow_active rule—the attacker forces the mount without the security flags. The malicious filesystem is then mounted with full root privileges, allowing execution of the SUID-root shell. Moreover, security researchers at Qualys have shown that CVE-2025-6019 can be chained with CVE-2025-6018, another recent LPE, to create a seamless path to root on most Linux distributions.

Conclusion

CVE-2025-6019 underscores the importance of strict mount policies and cautious Polkit configurations. Administrators should apply the latest patches for libblockdev and udisks immediately and review Polkit rules to limit allow_active permissions. If you’re running RHEL 7, 8, 9 or 10, ensure your systems are updated. Given the ability to chain this flaw with CVE-2025-6018, timely mitigation is critical to maintaining system integrity.

Watch the full video on YouTube: CVE-2025-6019

Remediation and exploitation details

This chain involves the following actors

  • Local Attacker: Unprivileged user with an active Polkit session

This following systems are involved

  • libblockdev (Library for block device management): Client interface to the disk management daemon
  • udisksd (Disk management daemon): Processes mount and resize requests
  • PolicyKit (Authorization framework): Determines which users can perform which actions

Attack entry point

  • Polkit allow_active setting: Allows physically present users to perform certain udisks actions without additional credentials
  • Crafted XFS image: Filesystem image embedding a SUID-root shell

Remediation actions

System Administrator
Update libblockdev to the fixed version
libblockdev
System Administrator
Apply vendor-supplied patches for RHEL and other affected distributions
Red Hat Enterprise Linux 7, 8, 9, 10 and other Linux distributions
System Administrator
Restrict Polkit allow_active permissions to only fully trusted sessions
PolicyKit

Exploitation actions

Filesystem image crafting

Local Attacker
Create a malicious XFS filesystem image containing a SUID-root binary
Local Filesystem
Examples:
  • mkfs.xfs -f malicious.xfs
  • guestfish --rw -a malicious.xfs -m /dev/sda1 'dd of=/shell bs=1 count=0 seek=0; chmod 4755 /shell'

udisksctl resize command

Local Attacker
Invoke libblockdev’s resize call via udisksctl
udisksd
Examples:
  • udisksctl resize -b malicious.xfs
  • udevadm settle

Insecure mount invocation

Local Attacker
Leverage Polkit allow_active to have udisksd mount the image without nosuid/nodev flags
udisksd
Examples:
  • mount -o loop malicious.xfs /mnt

Setuid execution

Local Attacker
Execute the embedded SUID-root shell from the mounted image to gain full root privileges
Mounted Filesystem
Examples:
  • /mnt/shell
  • id

Related Content

NOTE: The following related content has not been vetted and may be unsafe.

CVE database technical details

CVE ID
CVE-2025-6019
Description
A Local Privilege Escalation (LPE) vulnerability was found in libblockdev. Generally, the "allow_active" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an "allow_active" user on a system may be able escalate to full root privileges on the target host. Normally, udisks mounts user-provided filesystem images with security flags like nosuid and nodev to prevent privilege escalation. However, a local attacker can create a specially crafted XFS image containing a SUID-root shell, then trick udisks into resizing it. This mounts their malicious filesystem with root privileges, allowing them to execute their SUID-root shell and gain complete control of the system.
Provider
redhat
CWE / problem types
Execution with Unnecessary Privileges
Affected Software Versions
Red Hat:Red Hat Enterprise Linux 10:None,Red Hat:Red Hat Enterprise Linux 7:None,Red Hat:Red Hat Enterprise Linux 8:None,Red Hat:Red Hat Enterprise Linux 9:None
Date Published
2025-06-19T11:55:57.380Z
Last Updated
2025-06-19T12:07:16.097Z