Critical Privilege Escalation Vulnerabilities Allow Attackers to Gain Full Root Access on Linux

The Qualys Threat Research Unit (TRU) has disclosed two critical local privilege escalation (LPE) vulnerabilities—CVE-2025-6018 and CVE-2025-6019—that, when chained, enable unprivileged attackers to gain full root control on major Linux distributions.

This exploit chain leverages misconfigurations in SUSE’s Pluggable Authentication Modules (PAM) and a flaw in the ubiquitous libblockdev/udisks stack, posing a universal risk to Linux servers and workstations.

Exploit Chain Mechanics:

CVE-2025-6018 targets the PAM framework in openSUSE Leap 15 and SUSE Linux Enterprise 15, where a misconfigured session policy erroneously grants remote SSH users the “allow_active” privilege—a status typically reserved for physically present users.

This allows attackers to bypass polkit restrictions and execute privileged operations, such as mounting storage devices.

CVE-2025-6019 resides in libblockdev, a library used by the udisks daemon for block-device management.

By exploiting this flaw, an “allow_active” user can escalate to root via udisks’ D-Bus interface, which runs by default on most Linux systems.

Qualys TRU confirmed exploitability on Ubuntu, Debian, Fedora, and openSUSE, demonstrating root access within seconds.

Universal Risk Profile Across Linux Distributions

The chained vulnerabilities collapse the security boundary between local users and full system control:

• Ubiquity of udisks: The service is enabled by default on 98% of enterprise Linux systems, including servers.
• Low exploit complexity: Attackers require only SSH access or a local session, with no need for physical presence.
• Post-exploit impact: Root privileges allow disabling EDR agents, installing kernel backdoors, and rewriting persistent system configurations.

Organizations running SUSE 15, Ubuntu 24.04 LTS, or Fedora 40 are at immediate risk, as exploits leverage pre-installed components.

Mitigation and Patching Imperatives

Critical Configuration Changes

Modify the polkit rule for org.freedesktop.udisks2.modify-device to enforce administrative authentication:

bash# Change 'allow_active' from 'yes' to 'auth_admin'
polkit.addRule(function(action, subject) {
  if (action.id == "org.freedesktop.udisks2.modify-device") {
    return subject.active ? polkit.Result.AUTH_ADMIN : polkit.Result.NOT_HANDLED;
  }
});

Patch Deployment

Risk Factor Analysis

Qualys TRU urges organizations to prioritize patching both vulnerabilities, as unpatched systems risk fleet-wide compromise via lateral movement.

The Qualys VMDR platform provides real-time detection (QIDs: TBD) and remediation workflows to mitigate this critical threat.

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates