CVE-2025-8067

CVE-2025-8067 的概念验证 详细信息可在此处获取： https://github.com/storaged-project/udisks/security/advisories/GHSA-742q-gggc-473g https://www.openwall.com/lists/oss-security/2025/08/28/1 https://access.redhat.com/security/cve/CVE-2025-8067 https://ubuntu.com/security/CVE-2025-8067...

CVE-2025-6019

CVE-2025-6019 概念验证 PoC 此仓库包含针对 CVE-2025-6019 的概念验证 PoC 脚本，该漏洞是 libblockdev 和 udisks 中的本地权限提升 LPE 漏洞。该脚本创建一个包含 SUID bash 二进制的 XFS 文件系统镜像，并利用该漏洞在不使用 nosuid 选项的情况下挂载它，从而获得 root shell。 警告 ：此 PoC 仅用于教育和测试目的。只能在您有权测试的系统上使用。未经授权使用是非法且不道德的。 特性 本地模式 ：创建一个 300 MB 的 XFS 镜像，包含 SUID bash 二进制（需要 root 权限）。 目标模式...

oxasploits

oxasploits 由 oxagast 编写的一系列漏洞利用工具 大部分这些 CVE 也归属于 oxagast 联系方式：Marshall Whittaker [email protected] CVE 和 PoC 代码 CVE-2006-3392 Webmin =1.29 远程 root 漏洞利用 该漏洞利用通过目录遍历和任意读取漏洞窃取 Webmin cookie，然后复用该 cookie 来利用一个已认证用户漏洞，从而实现远程获取 root 权限。 CVE-2010-2626 针对 Miyabi CGI Tools =1.02 和 iOffice 0.1 的 Perl...

Astra Linux – Vulnerability in udisks2

A flaw was discovered in the Udisks daemon, where it allows unprivileged users to create loop devices using the D-BUS system. This is accomplished through the loop device handler, which processes requests sent through the D-BUS interface. As part of this handler’s functionality, it receives a lis...

Astra Linux – Vulnerability in libblockdev, udisks2

A Local Privilege Escalation LPE vulnerability was discovered in libblockdev. Typically, the “allowactive” setting in Polkit allows a physically present user to perform certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, a “allowactive” user on ...

CVE-2026-7867

Affected software: udisks2. Vulnerability: insufficient authorization check on the as-user parameter in org.freedesktop.UDisks2.Filesystem.Mount() allows a local attacker to spoof as-user and mount on behalf of arbitrary users, enabling local privilege escalation via mount point namespace manipul...

CVE-2026-7867 Udisks2: udisks2: local privilege escalation via as-user option spoofing

A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on...

CVE-2026-13595

A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be...

EUVD-2026-40053

A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be...

CVE-2026-13595

A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be...

CVE-2026-44710

pamusb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, src/device.c passed the return values of udisksdrivegetserial, udisksdrivegetvendor, and udisksdrivegetmodel directly to strcmp without NULL checks. The GIO/UDisks API documentation states these...

CVE-2026-44710

pamusb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, src/device.c passed the return values of udisksdrivegetserial, udisksdrivegetvendor, and udisksdrivegetmodel directly to strcmp without NULL checks. The GIO/UDisks API documentation states these...

CVE-2026-44710 pam_usb: NULL pointer dereference from UDisks device fields causes PAM crash and login denial-of-service

pamusb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, src/device.c passed the return values of udisksdrivegetserial, udisksdrivegetvendor, and udisksdrivegetmodel directly to strcmp without NULL checks. The GIO/UDisks API documentation states these...

CVE-2026-44710

pam_usb for Linux is affected by a NULL pointer dereference in src/device.c prior to 0.8.7, where return values from udisks_drive_get_serial(), udisks_drive_get_vendor(), and udisks_drive_get_model() were passed directly to strcmp() without NULL checks. The GIO/UDisks API can return NULL for thes...

CVE-2026-44710 pam_usb: NULL pointer dereference from UDisks device fields causes PAM crash and login denial-of-service

pamusb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, src/device.c passed the return values of udisksdrivegetserial, udisksdrivegetvendor, and udisksdrivegetmodel directly to strcmp without NULL checks. The GIO/UDisks API documentation states these...

CVE-2026-44710

pamusb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, src/device.c passed the return values of udisksdrivegetserial, udisksdrivegetvendor, and udisksdrivegetmodel directly to strcmp without NULL checks. The GIO/UDisks API documentation states these...

EUVD-2026-32660

pamusb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, src/device.c passed the return values of udisksdrivegetserial, udisksdrivegetvendor, and udisksdrivegetmodel directly to strcmp without NULL checks. The GIO/UDisks API documentation states these...

CVE-2026-44710 pam_usb: NULL pointer dereference from UDisks device fields causes PAM crash and login denial-of-service

pamusb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, src/device.c passed the return values of udisksdrivegetserial, udisksdrivegetvendor, and udisksdrivegetmodel directly to strcmp without NULL checks. The GIO/UDisks API documentation states these...

PT-2026-44110

Name of the Vulnerable Software and Affected Versions pam usb versions prior to 0.8.7 Description In src/device.c, the return values of the functions udisks drive get serial, udisks drive get vendor, and udisks drive get model are passed directly to strcmp without NULL checks. According to...

pam_usb 代码问题漏洞

pamusb is a Linux hardware authentication tool developed by McDope’s individual developer, based on USB devices. Versions of pamusb prior to 0.8.7 have code vulnerabilities. This vulnerability stems from the fact that in src/device.c, the return values of udisksdrivegetserial, udisksdrivegetvendo...