Описание
A Local Privilege Escalation (LPE) vulnerability was found in libblockdev. Generally, the "allow_active" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an "allow_active" user on a system may be able escalate to full root privileges on the target host. Normally, udisks mounts user-provided filesystem images with security flags like nosuid and nodev to prevent privilege escalation. However, a local attacker can create a specially crafted XFS image containing a SUID-root shell, then trick udisks into resizing it. This mounts their malicious filesystem with root privileges, allowing them to execute their SUID-root shell and gain complete control of the system.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | 3.3.0-2.1 |
| esm-infra/bionic | released | 2.16-2ubuntu0.1~esm1 |
| esm-infra/focal | released | 2.23-2ubuntu3+esm1 |
| jammy | released | 2.26-1ubuntu0.1 |
| noble | released | 3.1.1-1ubuntu0.1 |
| oracular | released | 3.1.1-2ubuntu0.1 |
| plucky | released | 3.3.0-2ubuntu0.1 |
| upstream | needs-triage |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | released | 2.10.1-12.1ubuntu1 |
| esm-infra-legacy/trusty | needs-triage | |
| esm-infra/bionic | released | 2.7.6-3ubuntu0.2+esm1 |
| esm-infra/focal | released | 2.8.4-1ubuntu2+esm1 |
| esm-infra/xenial | needs-triage | |
| jammy | released | 2.9.4-1ubuntu2.2 |
| noble | released | 2.10.1-6ubuntu1.2 |
| oracular | released | 2.10.1-9ubuntu3.2 |
| plucky | released | 2.10.1-11ubuntu2.2 |
| upstream | needs-triage |
Показывать по
Ссылки на источники
EPSS
7 High
CVSS3
Связанные уязвимости
A Local Privilege Escalation (LPE) vulnerability was found in libblockdev. Generally, the "allow_active" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an "allow_active" user on a system may be able escalate to full root privileges on the target host. Normally, udisks mounts user-provided filesystem images with security flags like nosuid and nodev to prevent privilege escalation. However, a local attacker can create a specially crafted XFS image containing a SUID-root shell, then trick udisks into resizing it. This mounts their malicious filesystem with root privileges, allowing them to execute their SUID-root shell and gain complete control of the system.
A Local Privilege Escalation (LPE) vulnerability was found in libblockdev. Generally, the "allow_active" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an "allow_active" user on a system may be able escalate to full root privileges on the target host. Normally, udisks mounts user-provided filesystem images with security flags like nosuid and nodev to prevent privilege escalation. However, a local attacker can create a specially crafted XFS image containing a SUID-root shell, then trick udisks into resizing it. This mounts their malicious filesystem with root privileges, allowing them to execute their SUID-root shell and gain complete control of the system.
A Local Privilege Escalation (LPE) vulnerability was found in libblock ...
EPSS
7 High
CVSS3