Описание
A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on behalf of arbitrary users, including privileged accounts. This can lead to local privilege escalation through mount point injection and manipulation of the mount namespace visible to privileged users.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| udisks2 | fixed | 2.11.2-1 | package | |
| udisks2 | not-affected | bookworm | package | |
| udisks2 | not-affected | bullseye | package |
Примечания
https://github.com/azqzazq1/CVE-2026-7867-disk2root
https://github.com/storaged-project/udisks/security/advisories/GHSA-j42g-v9jw-6ph3
https://github.com/storaged-project/udisks/commit/397eea88d58f77f6e02d537c4c961201b9245943
https://github.com/storaged-project/udisks/commit/0050f51d40e468f6a3197ccdc77b5bd59c923a37
https://github.com/storaged-project/udisks/commit/98e5a76c155640d155280cdb642791f00def736a
https://github.com/storaged-project/udisks/commit/681d58a76f6aaa5045eb43e665c65f497d35b810
https://github.com/storaged-project/udisks/commit/36231768dde088c8b4d4796ff2d311d089d84052
Backport for 2.10.y: https://github.com/storaged-project/udisks/pull/1530
Связанные уязвимости
A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on behalf of arbitrary users, including privileged accounts. This can lead to local privilege escalation through mount point injection and manipulation of the mount namespace visible to privileged users.
A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on behalf of arbitrary users, including privileged accounts. This can lead to local privilege escalation through mount point injection and manipulation of the mount namespace visible to privileged users.
A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on behalf of arbitrary users, including privileged accounts. This can lead to local privilege escalation through mount point injection and manipulation of the mount namespace visible to privileged users.
