CVE-2025-6019

CVE-2025-6019 Proof of Concept PoC This repository contains a Proof of Concept PoC script for CVE-2025-6019 , a Local Privilege Escalation LPE vulnerability in libblockdev and udisks. The script creates an XFS filesystem image with an SUID bash binary and exploits the vulnerability to mount it...

opensuse-leap-privesc-exploit

CVE-2025-6018 + CVE-2025-6019 Exploit Chain This exploit was developed to solve a HackTheBox challenge targeting openSUSE Leap 15.6. Credits This exploit is based on the original research by the Qualys Security Team: Advisory: https://cdn2.qualys.com/2025/06/17/suse15-pam-udisks-lpe.txt...

CVE-2025-6019

CVE-2025-6019: libblockdev Local Privilege Escalation Vulnerability Summary CVE-2025-6019 is a local privilege escalation LPE vulnerability discovered in the libblockdev library, which interacts with the udisks2 daemon and Polkit. Vulnerability Description A local attacker with allowactive Polkit...

Exploit-Chain-CVE-2025-6018-6019

https://cdn2.qualys.com/2025/06/17/suse15-pam-udisks-lpe.txt This exploit chains CVE-2025-6018 and CVE-2025-6019 to achieve local privilege escalation from an unprivileged user to root on vulnerable SUSE/openSUSE systems. CVE-2025-6018 is a PAM Pluggable Authentication Modules environment variabl...

CVE-2025-6018-and-CVE-2025-6019

Check Its Vulnerable or not rpm -q pam || dpkg -l | grep libpam or find /etc/pam.d/ -name '' -exec grep -l 'pamenv' \; 2/dev/null or find /etc/pam.d/ -name '' -exec grep -l 'pamsystemd' \; 2/dev/null or systemctl --version | head -1 If version Include :Vulnerable PAM version detected Reference...

CVE-2025-6018-6019-PoC

CVE-2025-6018 & CVE-2025-6019: Local Privilege Escalation PoC A robust Proof of Concept PoC for chaining CVE-2025-6018 PAM/Polkit Active Session Bypass and CVE-2025-6019 libblockdev SUID Mount Flaw to achieve root access on vulnerable Linux systems. Disclaimer This tool is for educational purpose...

CVE-2026-6018-9-Local-Privilege-Escalation-Chain

CVE-2025-6018 + CVE-2025-6019: Local Privilege Escalation Chain Target OS: openSUSE Leap 15.x / SUSE Linux Enterprise 15.x Required access: Unprivileged local user with SSH access Result: Full root shell Overview This document details the manual exploitation of two chained local privilege...

CVE-2026-111581

A flaw was found in libblockdev. The bdfsntfssetlabel and bdfsvfatsetlabel functions pass caller-supplied label values as bare positional arguments to the ntfslabel and fatlabel utilities without end-of-options separators or input validation for values beginning with a dash. This allows a label...

CVE-2026-111581

A flaw in libblockdev allows unprivileged local users to perform argument injection via the udisks2 Filesystem.SetLabel() D-Bus method . The bd_fs_ntfs_set_label() and bd_fs_vfat_set_label() functions pass caller-supplied labels as bare positional arguments to the ntfslabel and fatlabel utilities...

CVE-2026-111581 Libblockdev: libblockdev: argument injection in ntfs/vfat label-setting helpers via udisks2 setlabel() d-bus method

A flaw was found in libblockdev. The bdfsntfssetlabel and bdfsvfatsetlabel functions pass caller-supplied label values as bare positional arguments to the ntfslabel and fatlabel utilities without end-of-options separators or input validation for values beginning with a dash. This allows a label...

EUVD-2026-102935

A flaw was found in libblockdev. The bdfsntfssetlabel and bdfsvfatsetlabel functions pass caller-supplied label values as bare positional arguments to the ntfslabel and fatlabel utilities without end-of-options separators or input validation for values beginning with a dash. This allows a label...

CVE-2026-111581

A flaw was found in libblockdev. The bdfsntfssetlabel and bdfsvfatsetlabel functions pass caller-supplied label values as bare positional arguments to the ntfslabel and fatlabel utilities without end-of-options separators or input validation for values beginning with a dash. This allows a label...

PT-2026-115633

Name of the Vulnerable Software and Affected Versions libblockdev affected versions not specified Description An issue exists where the bd fs ntfs set label and bd fs vfat set label functions pass user-supplied label values to the ntfslabel and fatlabel utilities without proper input validation o...

CVE-2026-111581: Improper Neutralization of Argument Delimiters in a Command

A flaw was found in libblockdev. The bdfsntfssetlabel and bdfsvfatsetlabel functions pass caller-supplied label values as bare positional arguments to the ntfslabel and fatlabel utilities without end-of-options separators or input validation for values beginning with a dash. This allows a label...

Linux Distros Unpatched Vulnerability : CVE-2026-111581

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in libblockdev. The bdfsntfssetlabel and bdfsvfatsetlabel functions pass caller-supplied label values as bare positional arguments to the...

Rocky Linux 8 [CIQ] Security Update: libblockdev / libblockdev-crypto / libblockdev-crypto-debuginfo / etc (crlsa-2025_9878)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20259878 advisory. libblockdev: LPE from allowactive to root in libblockdev via udisks CVE-2025-6019 Tenable has extracted the preceding description block directly from the CIQ securi...

Rocky Linux 8.6 [CIQ] Security Update: libblockdev / libblockdev-crypto / libblockdev-crypto-debuginfo / etc (ciqsa-2026_0071)

The Rocky Linux 8.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20260071 advisory. This advisory aggregates security fixes for the libblockdev SRPM in CIQ LTS 8.6. It addresses 1 CVE: CVE-2025-6019. Tenable has extracted the preceding descriptio...

AlmaLinux 9.2 [TuxCare] Security Update: libblockdev / libblockdev-crypto / libblockdev-crypto-devel / etc (ALMALINUX9.2:CLSA-2025:1754340109)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1754340109 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL...

Rocky Linux 9.2 [CIQ] Security Update: libblockdev / libblockdev-crypto / libblockdev-crypto-debuginfo / etc (ciqsa-2026_0441)

The Rocky Linux 9.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20260441 advisory. This advisory aggregates security fixes for the libblockdev SRPM in CIQ LTS 9.2. It addresses 1 CVE: CVE-2025-6019. Tenable has extracted the preceding descriptio...

Rocky Linux 9 [CIQ] Security Update: libblockdev / libblockdev-crypto / libblockdev-crypto-debuginfo / etc (crlsa-2025_9327)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20259327 advisory. libblockdev: LPE from allowactive to root in libblockdev via udisks CVE-2025-6019 Tenable has extracted the preceding description block directly from the CIQ securi...