Critical Linux Flaws Discovered Allowing Root Access Exploits
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-6018 | A Local Privilege Escalation (LPE) vulnerability has been discovered in pam-config within Linux Pluggable Authentication Modules (PAM). A Local Privilege Escalation (LPE) vulnerability has been discovered in pam-config within Linux Pluggable Authentication Modules (PAM). This flaw allows an unprivileged local attacker (for example, a user logged in via SSH) to obtain the elevated privileges normally reserved for a physically present, "allow_active" user. The highest risk is that the attacker can then perform all allow_active yes Polkit actions, which are typically restricted to console users, potentially gaining unauthorized control over system configurations, services, or other sensitive operations. NVD description · AI analysis pending | 7.8 | 1% | PoC ×2 |
| — | |
| CVE-2025-6019 | A Local Privilege Escalation (LPE) vulnerability was found in libblockdev. A Local Privilege Escalation (LPE) vulnerability was found in libblockdev. Generally, the "allow_active" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an "allow_active" user on a system may be able escalate to full root privileges on the target host. Normally, udisks mounts user-provided filesystem images with security flags like nosuid and nodev to prevent privilege escalation. However, a local attacker can create a specially crafted XFS image containing a SUID-root shell, then trick udisks into resizing it. This mounts their malicious filesystem with root privileges, allowing them to execute their SUID-root shell and gain complete control of the system. NVD description · AI analysis pending | 7.0 | <1% | — | — |
Full article375 words · extracted from infosecurity-magazine.com · click to collapse
Two new vulnerabilities have been discovered in widely deployed Linux components that could allow unprivileged users to gain root access across popular distributions.
The first is a local privilege escalation (LPE) flaw tracked as CVE-2025-6018, which affects the PAM configuration in openSUSE Leap 15 and SUSE Linux Enterprise 15.
This misconfiguration allows any local login session, including those over SSH, to be treated as if the user were physically present. That status, known as “allow_active,” grants access to certain privileged operations typically reserved for users on the machine.
The second vulnerability, CVE-2025-6019, resides in libblockdev and can be triggered via the udisks daemon, which is installed by default on nearly all Linux distributions. Once a user obtains allow_active status, this flaw enables full root access.
Combined, these two flaws create a direct and low-effort path from unprivileged to root access.
Exploit Chain Impacts Multiple Distributions
The udisks daemon and its libblockdev backend are used for managing disks and storage devices. By design, they grant more privileges to users marked as “active.” The PAM flaw subverts this trust model, turning routine sessions into security liabilities.
The exploit chain is especially dangerous because no extra software or physical access is required, just a working SSH login to a vulnerable system.
The Qualys Threat Research Unit (TRU) has successfully demonstrated this exploit chain on Ubuntu, Debian, Fedora and openSUSE Leap 15. Its significance lies in how easily attackers can leap from a standard SSH session to full root privileges using only default-installed components.
“Nothing exotic is required,” TRU researchers said.
“Each link is pre-installed on mainstream Linux distros and their server builds.”
Key risks include:
-
Complete takeover of affected systems
-
Evasion of endpoint detection tools
-
Installation of persistent backdoors
-
Fleet-wide compromise via lateral movement
Read more on Linux vulnerabilities: New Linux Vulnerabilities Surge 967% in a Year
Mitigation and Recommendations
Security teams are urged to patch both vulnerabilities immediately.
In addition, they are advised to:
-
Modify the default polkit rule for org.freedesktop.udisks2.modify-device
-
Change the allow_active setting from yes to auth_admin
-
Follow vendor advisories for SUSE, Ubuntu and others
Failing to act quickly may leave entire fleets exposed to compromise. The root access granted through this exploit enables undetectable persistence and cross-system attacks, amplifying the risk to enterprise infrastructure.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/linux-flaws-allowing-root-access/