Udisks: missing authorization check allows unprivileged users to restore luks headers via udisks d-bus api

A flaw was found in the udisks storage management daemon that exposes a privileged D-Bus API for restoring LUKS encryption headers without proper authorization checks. The issue allows a local unprivileged user to instruct the root-owned udisks daemon to overwrite encryption metadata on block devices. This can permanently invalidate encryption keys and render encrypted volumes inaccessible. Successful exploitation results in a denial-of-service condition through irreversible data loss.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

授权机制缺失

udisks 安全漏洞

udisks是storaged-project开源的一款用于查询和管理存储设备的守护程序。 udisks存在安全漏洞，该漏洞源于特权D-Bus API缺少授权检查，可能导致本地非特权用户覆盖加密元数据，造成拒绝服务。

N/A

N/A