29 matches found
needrestart-privesc-cve-2024-48990
needrestart 권한 상승 CVE-2024-48990 이 저장소는 needrestart CVE-2024-48990의 취약점을 대상으로 하는 최소한의 로컬 권한 상승 익스플로잇을 포함합니다. 이 취약점은 권한이 있는 컨텍스트에서 파싱되고 실행되는 -c 설정 옵션을 남용하여 루트로 임의의 Perl 코드를 실행할 수 있게 합니다. 배경 많은 기존 권한 상승 익스플로잇은 사용자 정의 바이너리 컴파일, 추가 셸 실행, 또는 대화형 명령 체인에 의존해야 합니다. 이 익스플로잇은 컴파일, 추가 도구, 또는 대화형 편집기/페이저 남용 ...
NimbusPWN-CVE-2022-29799-29800
NimbusPwn — networkd-dispatcher !NOTE 다른 배포판: dnf install gcc dbus-devel pkgconf Fedora/RHEL 또는 pacman -S gcc dbus pkgconf Arch. 컴파일 명령은 동일합니다. ⚙️ 사용법 취약한 호스트에서 권한이 없는 사용자로 실행합니다. ./nimbuspwn -c -s SHELL -c, --check non-breaking vuln check, no exploitation -s, --shell SHELL shell to...
CVE-2025-6019
CVE-2025-6019: libblockdev 로컬 권한 상승 취약점 요약 CVE-2025-6019는 libblockdev 라이브러리에서 발견된 로컬 권한 상승LPE 취약점으로, udisks2 데몬 및 Polkit과 함께 작용합니다. 취약점 설명 allowactive Polkit 권한을 가진 로컬 공격자일반적으로 실제 컴퓨터 사용자는 libblockdev와 udisks 데몬이 상호작용하는 방식을 악용할 수 있습니다. 공격자는 SUID-root 셸을 포함하는 악성 XFS 이미지를 생성하고, udisks가 nosuid 및...
CVE-2026-41651
CVE-2026-41651 CVSS 3.x : 7.8 HIGH CWE : CWE-367 Time-of-Check Time-of-Use Fix : PackageKit 1.3.5+ Affects : PackageKit 1.0.2 – 1.3.4 PackageKit의 D-Bus 트랜잭션 핸들러에서 TOCTOU 레이스 컨디션을 통한 로컬 권한 상승입니다. 권한이 없는 모든 로컬 사용자는 로컬 세션 외에 추가 인증 없이 루트 권한으로 임의의 패키지를 설치할 수 있습니다. 랩 / 승인된 테스트 전용 HTB, CTF, 서면 범위가 명시된 작...
TencentOS Server 4: udisks2 (TSSA-2025:0480)
The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0480 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...
EulerOS 2.0 SP13 : udisks2 (EulerOS-SA-2025-2312)
According to the versions of the udisks2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A Local Privilege Escalation LPE vulnerability was found in libblockdev. Generally, the 'allowactive' setting in Polkit permits a physically...
EulerOS 2.0 SP13 : libblockdev (EulerOS-SA-2025-2266)
According to the versions of the libblockdev packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A Local Privilege Escalation LPE vulnerability was found in libblockdev. Generally, the 'allowactive' setting in Polkit permits a physically...
EulerOS 2.0 SP11 : libblockdev (EulerOS-SA-2025-2200)
According to the versions of the libblockdev packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A Local Privilege Escalation LPE vulnerability was found in libblockdev. Generally, the 'allowactive' setting in Polkit permits a physically...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: udisks2 (UTSA-2025-587571)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-587571 advisory. A Local Privilege Escalation LPE vulnerability was found in libblockdev. Generally, the allowactive setting in Polkit permits a physically present user to take certa...
EulerOS 2.0 SP12 : udisks2 (EulerOS-SA-2025-2061)
According to the versions of the udisks2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A Local Privilege Escalation LPE vulnerability was found in libblockdev. Generally, the 'allowactive' setting in Polkit permits a physically...
EulerOS 2.0 SP12 : udisks2 (EulerOS-SA-2025-2030)
According to the versions of the udisks2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A Local Privilege Escalation LPE vulnerability was found in libblockdev. Generally, the 'allowactive' setting in Polkit permits a physically...
Linux Distros Unpatched Vulnerability : CVE-2025-6019
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A Local Privilege Escalation LPE vulnerability was found in libblockdev. Generally, the allowactive setting in Polkit permits a physically present user to take...
CLSA-2025-1754340109 libblockdev: Fix of CVE-2025-6019
CVE-2025-6019: fix local privilege escalation vulnerability by updating libblockdev to prevent mounting of user-provided filesystem images with SUID- root shell...
MGASA-2025-0188 Updated udisks2 & libblockdev packages fix security vulnerabilities
A Local Privilege Escalation LPE vulnerability was found in libblockdev. Generally, the "allowactive" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an "allowactive" user on a syst...
AZL-64187 CVE-2025-6019 affecting package libblockdev 2.28-3
A Local Privilege Escalation LPE vulnerability was found in libblockdev. Generally, the "allowactive" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an "allowactive" user on a syst...
DEBIAN-CVE-2025-6019
A Local Privilege Escalation LPE vulnerability was found in libblockdev. Generally, the "allowactive" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an "allowactive" user on a syst...
CVE-2025-6019
A Local Privilege Escalation LPE vulnerability was found in libblockdev. Generally, the "allowactive" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an "allowactive" user on a syst...
CVE-2025-6019 Libblockdev: lpe from allow_active to root in libblockdev via udisks
A Local Privilege Escalation LPE vulnerability was found in libblockdev. Generally, the "allowactive" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an "allowactive" user on a syst...
CVE-2025-6019
CVE-2025-6019 is a local privilege escalation in libblockdev that leverages the interaction with the udisks daemon and the Polkit “allow_active” setting to allow a physically present user to escalate to root. The issue arises when an attacker crafts an XFS image containing a SUID-root shell and m...
CVE-2025-6019 Libblockdev: lpe from allow_active to root in libblockdev via udisks
A Local Privilege Escalation LPE vulnerability was found in libblockdev. Generally, the "allowactive" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an "allowactive" user on a syst...