Log in Start free

Vulnerability · Published Aug 28, 2025 · Assigned by redhat

CVE-2025-8067Udisks: out-of-bounds read in udisks daemon

High 8.5

In plain English

A high-severity out-of-bounds read in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 51% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.5High
Exploit odds (30 days)0.7%top 48.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

A flaw was found in the Udisks daemon, where it allows unprivileged users to create loop devices using the D-BUS system. This is achieved via the loop device handler, which handles requests sent through the D-BUS interface. As two of the parameters of this handle, it receives the file descriptor list and index specifying the file where the loop device should be backed. The function itself validates the index value to ensure it isn't bigger than the maximum value allowed. However, it fails to validate the lower bound, allowing the index parameter to be a negative value. Under these circumstances, an attacker can cause the UDisks daemon to crash or perform a local privilege escalation by gaining access to files owned by privileged users.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10libudisks22.10.90-5.el10_0.1ALSA-2025:15020
AlmaLinux:8libudisks22.9.0-16.el8_10.1ALSA-2025:15017
AlmaLinux:9libudisks22.9.4-11.el9_6.1ALSA-2025:15018
AlmaLinux:10libudisks2-devel2.10.90-5.el10_0.1ALSA-2025:15020
AlmaLinux:8libudisks2-devel2.9.0-16.el8_10.1ALSA-2025:15017
AlmaLinux:9libudisks2-devel2.9.4-11.el9_6.1ALSA-2025:15018
AlmaLinux:10udisks22.10.90-5.el10_0.1ALSA-2025:15020
AlmaLinux:8udisks22.9.0-16.el8_10.1ALSA-2025:15017
AlmaLinux:9udisks22.9.4-11.el9_6.1ALSA-2025:15018
AlmaLinux:10udisks2-iscsi2.10.90-5.el10_0.1ALSA-2025:15020
AlmaLinux:8udisks2-iscsi2.9.0-16.el8_10.1ALSA-2025:15017
AlmaLinux:9udisks2-iscsi2.9.4-11.el9_6.1ALSA-2025:15018
AlmaLinux:10udisks2-lsm2.10.90-5.el10_0.1ALSA-2025:15020
AlmaLinux:8udisks2-lsm2.9.0-16.el8_10.1ALSA-2025:15017
AlmaLinux:9udisks2-lsm2.9.4-11.el9_6.1ALSA-2025:15018
AlmaLinux:10udisks2-lvm22.10.90-5.el10_0.1ALSA-2025:15020
AlmaLinux:8udisks2-lvm22.9.0-16.el8_10.1ALSA-2025:15017
AlmaLinux:9udisks2-lvm22.9.4-11.el9_6.1ALSA-2025:15018
Debian:12udisks22.9.4-4+deb12u2DEBIAN-CVE-2025-8067
Debian:12udisks22.9.4-4+deb12u2DSA-5989-1
Debian:13udisks22.10.1-12.1+deb13u1DSA-5989-1
Debian:13udisks22.10.1-12.1+deb13u1DEBIAN-CVE-2025-8067
Debian:14udisks22.10.90-3.1DEBIAN-CVE-2025-8067
Rocky Linux:10udisks20:2.10.90-5.el10_0.1RLSA-2025:15020
Rocky Linux:8udisks20:2.9.0-16.el8_10.1RLSA-2025:15017
Rocky Linux:9udisks20:2.9.4-11.el9_6.1RLSA-2025:15018
Ubuntu:22.04:LTSudisks22.9.4-1ubuntu2.3USN-7723-1
Ubuntu:22.04:LTSudisks22.9.4-1ubuntu2.3UBUNTU-CVE-2025-8067
Ubuntu:24.04:LTSudisks22.10.1-6ubuntu1.3USN-7723-1
Ubuntu:24.04:LTSudisks22.10.1-6ubuntu1.3UBUNTU-CVE-2025-8067

Affected products (as reported)

VendorProductVersions
storaged-project udisks 0 – before 2.10.22.10.3 – before 2.10.91
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support see references
Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support see references
Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On see references
Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support see references
Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service see references
Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service see references
Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support see references
Red Hat Red Hat Enterprise Linux 6 see references

Weakness: CWE-125 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H

References