CVE-2025-8067
Full vulnerability record from the local CVENow database.
Description
A flaw was found in the Udisks daemon, where it allows unprivileged users to create loop devices using the D-BUS system. This is achieved via the loop device handler, which handles requests sent through the D-BUS interface. As two of the parameters of this handle, it receives the file descriptor list and index specifying the file where the loop device should be backed. The function itself validates the index value to ensure it isn't bigger than the maximum value allowed. However, it fails to validate the lower bound, allowing the index parameter to be a negative value. Under these circumstances, an attacker can cause the UDisks daemon to crash or perform a local privilege escalation by gaining access to files owned by privileged users.
Severity
HIGH
CVSS score
8.5
(v3.1)
Vulnerability status
Deferred
Source identifier
Published
2025-08-28 15:16:03.600000
Last modified
2026-11-04 22:17:40.463000
View original CVE JSON
{
"id": "CVE-2025-8067",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T15:16:03.600",
"lastModified": "2026-11-04T22:17:40.463",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Udisks daemon, where it allows unprivileged users to create loop devices using the D-BUS system. This is achieved via the loop device handler, which handles requests sent through the D-BUS interface. As two of the parameters of this handle, it receives the file descriptor list and index specifying the file where the loop device should be backed. The function itself validates the index value to ensure it isn't bigger than the maximum value allowed. However, it fails to validate the lower bound, allowing the index parameter to be a negative value. Under these circumstances, an attacker can cause the UDisks daemon to crash or perform a local privilege escalation by gaining access to files owned by privileged users."
},
{
"lang": "es",
"value": "Se encontró una falla en el demonio Udisks, donde permite a usuarios sin privilegios crear dispositivos de bucle utilizando el sistema D-BUS. Esto se logra a través del manejador de dispositivos de bucle, que maneja las solicitudes enviadas a través de la interfaz D-BUS. Como dos de los parámetros de este manejador, recibe la lista de descriptores de archivo y el índice que especifica el archivo donde el dispositivo de bucle debe ser respaldado. La función en sí valida el valor del índice para asegurar que no sea mayor que el valor máximo permitido. Sin embargo, no valida el límite inferior, permitiendo que el parámetro de índice sea un valor negativo. Bajo estas circunstancias, un atacante puede causar que el demonio UDisks falle o realizar una escalada de privilegios local al obtener acceso a archivos propiedad de usuarios privilegiados."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "storaged-project",
"product": "udisks",
"defaultStatus": "unaffected",
"collectionURL": "https://github.com/storaged-project/udisks",
"packageName": "udisks2",
"versions": [
{
"version": "0",
"lessThan": "2.10.2",
"versionType": "semver",
"status": "affected"
},
{
"version": "2.10.3",
"lessThan": "2.10.91",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "udisks2",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.0"
],
"versions": [
{
"version": "0:2.10.90-5.el10_0.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "udisks2",
"cpes": [
"cpe:/o:redhat:rhel_els:7"
],
"versions": [
{
"version": "0:2.8.4-1.el7_9.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "udisks2",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::appstream",
"cpe:/a:redhat:enterprise_linux:8::crb"
],
"versions": [
{
"version": "0:2.9.0-16.el8_10.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.2 Advanced Update Support",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "udisks2",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.2::appstream"
],
"versions": [
{
"version": "0:2.8.3-2.el8_2.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "udisks2",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.4::appstream",
"cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"
],
"versions": [
{
"version": "0:2.9.0-6.el8_4.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "udisks2",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.4::appstream",
"cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"
],
"versions": [
{
"version": "0:2.9.0-6.el8_4.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "udisks2",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.6::appstream",
"cpe:/a:redhat:rhel_e4s:8.6::appstream",
"cpe:/a:redhat:rhel_tus:8.6::appstream"
],
"versions": [
{
"version": "0:2.9.0-9.el8_6.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "udisks2",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.6::appstream",
"cpe:/a:redhat:rhel_e4s:8.6::appstream",
"cpe:/a:redhat:rhel_tus:8.6::appstream"
],
"versions": [
{
"version": "0:2.9.0-9.el8_6.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "udisks2",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.6::appstream",
"cpe:/a:redhat:rhel_e4s:8.6::appstream",
"cpe:/a:redhat:rhel_tus:8.6::appstream"
],
"versions": [
{
"version": "0:2.9.0-9.el8_6.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "udisks2",
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.8::appstream",
"cpe:/a:redhat:rhel_tus:8.8::appstream"
],
"versions": [
{
"version": "0:2.9.0-13.el8_8.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "udisks2",
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.8::appstream",
"cpe:/a:redhat:rhel_tus:8.8::appstream"
],
"versions": [
{
"version": "0:2.9.0-13.el8_8.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "udisks2",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/a:redhat:enterprise_linux:9::crb"
],
"versions": [
{
"version": "0:2.9.4-11.el9_6.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "udisks2",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.0::appstream"
],
"versions": [
{
"version": "0:2.9.4-3.el9_0.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "udisks2",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2::appstream"
],
"versions": [
{
"version": "0:2.9.4-7.el9_2.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "udisks2",
"cpes": [
"cpe:/a:redhat:rhel_eus:9.4::appstream",
"cpe:/a:redhat:rhel_eus:9.4::crb"
],
"versions": [
{
"version": "0:2.9.4-10.el9_4.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
"defaultStatus": "unknown",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "udisks",
"cpes": [
"cpe:/o:redhat:rhel_els:6"
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.5,
"impactScore": 5.3
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-08-28T16:20:49.738181Z",
"id": "CVE-2025-8067",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-125"
}
]
}
],
"references": [
{
"url": "https://access.redhat.com/errata/RHSA-2025:15017",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:15018",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:15020",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:15956",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:16021",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:16090",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:16106",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:16121",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:16122",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:16125",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:16130",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-8067",
"source": "[email protected]"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2388623",
"source": "[email protected]"
},
{
"url": "http://www.openwall.com/lists/oss-security/2025/08/28/1",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00023.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
]
}