CVE-2025-8067
Estado: AplazadaAlta (8.5)—
A flaw was found in the Udisks daemon, where it allows unprivileged users to create loop devices using the D-BUS system. This is achieved via the loop device handler, which handles requests sent through the D-BUS interface. As two of the parameters of this handle, it receives the file descriptor list and index specifying the file where the loop device should be backed. The function itself validates the index value to ensure it isn't bigger than the maximum value allowed. However, it fails to validate the lower bound, allowing the index parameter to be a negative value. Under these circumstances, an attacker can cause the UDisks daemon to crash or perform a local privilege escalation by gaining access to files owned by privileged users.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H
- Puntuación base: 8.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.65%
- Percentil entre todas las CVEs puntuadas: 50
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
🎯 Técnicas ATT&CK
Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.
- Explotación
T1068Exploitation for Privilege Escalationprivilege escalation90 % - Impacto secundario
T1499.004Application or System Exploitationimpact80 %
AV:L (acceso local sin privilegios) sin interacción de usuario indica escalada. El índice negativo en dbus permite crash de daemon (DoS) o acceso a archivos privilegiados; ejecución de código o comandos con permisos elevados.
Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.
🛡️ Mitigaciones ATT&CK que cubren estas técnicas
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
CWE
- CWE-125
Referencias
- https://access.redhat.com/errata/RHSA-2025:15017
- https://access.redhat.com/errata/RHSA-2025:15018
- https://access.redhat.com/errata/RHSA-2025:15020
- https://access.redhat.com/errata/RHSA-2025:15956
- https://access.redhat.com/errata/RHSA-2025:16021
- https://access.redhat.com/errata/RHSA-2025:16090
- https://access.redhat.com/errata/RHSA-2025:16106
- https://access.redhat.com/errata/RHSA-2025:16121
- https://access.redhat.com/errata/RHSA-2025:16122
- https://access.redhat.com/errata/RHSA-2025:16125
- https://access.redhat.com/errata/RHSA-2025:16130
- https://access.redhat.com/security/cve/CVE-2025-8067
- https://bugzilla.redhat.com/show_bug.cgi?id=2388623
- http://www.openwall.com/lists/oss-security/2025/08/28/1
- https://lists.debian.org/debian-lts-announce/2025/08/msg00023.html
JSON original (NVD)
Mostrar
{
"id": "CVE-2025-8067",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2025-8067",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2025-08-28T16:20:49.738181Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "secalert@redhat.com",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 8.5,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H",
"integrityImpact": "LOW",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "LOW"
},
"impactScore": 5.3,
"exploitabilityScore": 2.5
}
]
},
"affected": [
{
"source": "secalert@redhat.com",
"affectedData": [
{
"vendor": "storaged-project",
"product": "udisks",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "2.10.2",
"versionType": "semver"
},
{
"status": "affected",
"version": "2.10.3",
"lessThan": "2.10.91",
"versionType": "semver"
}
],
"packageName": "udisks2",
"collectionURL": "https://github.com/storaged-project/udisks",
"defaultStatus": "unaffected"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.0"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"versions": [
{
"status": "unaffected",
"version": "0:2.10.90-5.el10_0.1",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "udisks2",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/o:redhat:rhel_els:7"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
"versions": [
{
"status": "unaffected",
"version": "0:2.8.4-1.el7_9.2",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "udisks2",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::appstream",
"cpe:/a:redhat:enterprise_linux:8::crb"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"versions": [
{
"status": "unaffected",
"version": "0:2.9.0-16.el8_10.1",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "udisks2",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_aus:8.2::appstream"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.2 Advanced Update Support",
"versions": [
{
"status": "unaffected",
"version": "0:2.8.3-2.el8_2.1",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "udisks2",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_aus:8.4::appstream",
"cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
"versions": [
{
"status": "unaffected",
"version": "0:2.9.0-6.el8_4.1",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "udisks2",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_aus:8.4::appstream",
"cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
"versions": [
{
"status": "unaffected",
"version": "0:2.9.0-6.el8_4.1",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "udisks2",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_aus:8.6::appstream",
"cpe:/a:redhat:rhel_e4s:8.6::appstream",
"cpe:/a:redhat:rhel_tus:8.6::appstream"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
"versions": [
{
"status": "unaffected",
"version": "0:2.9.0-9.el8_6.1",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "udisks2",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_aus:8.6::appstream",
"cpe:/a:redhat:rhel_e4s:8.6::appstream",
"cpe:/a:redhat:rhel_tus:8.6::appstream"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
"versions": [
{
"status": "unaffected",
"version": "0:2.9.0-9.el8_6.1",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "udisks2",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_aus:8.6::appstream",
"cpe:/a:redhat:rhel_e4s:8.6::appstream",
"cpe:/a:redhat:rhel_tus:8.6::appstream"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
"versions": [
{
"status": "unaffected",
"version": "0:2.9.0-9.el8_6.1",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "udisks2",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.8::appstream",
"cpe:/a:redhat:rhel_tus:8.8::appstream"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
"versions": [
{
"status": "unaffected",
"version": "0:2.9.0-13.el8_8.1",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "udisks2",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.8::appstream",
"cpe:/a:redhat:rhel_tus:8.8::appstream"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"versions": [
{
"status": "unaffected",
"version": "0:2.9.0-13.el8_8.1",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "udisks2",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/a:redhat:enterprise_linux:9::crb"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"versions": [
{
"status": "unaffected",
"version": "0:2.9.4-11.el9_6.1",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "udisks2",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.0::appstream"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
"versions": [
{
"status": "unaffected",
"version": "0:2.9.4-3.el9_0.2",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "udisks2",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2::appstream"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"versions": [
{
"status": "unaffected",
"version": "0:2.9.4-7.el9_2.2",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "udisks2",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_eus:9.4::appstream",
"cpe:/a:redhat:rhel_eus:9.4::crb"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
"versions": [
{
"status": "unaffected",
"version": "0:2.9.4-10.el9_4.2",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "udisks2",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
"packageName": "udisks",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unknown"
}
]
}
],
"published": "2025-08-28T15:16:03.600",
"references": [
{
"url": "https://access.redhat.com/errata/RHSA-2025:15017",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:15018",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:15020",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:15956",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:16021",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:16090",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:16106",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:16121",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:16122",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:16125",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:16130",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-8067",
"source": "secalert@redhat.com"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2388623",
"source": "secalert@redhat.com"
},
{
"url": "http://www.openwall.com/lists/oss-security/2025/08/28/1",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00023.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Deferred",
"weaknesses": [
{
"type": "Secondary",
"source": "secalert@redhat.com",
"description": [
{
"lang": "en",
"value": "CWE-125"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Udisks daemon, where it allows unprivileged users to create loop devices using the D-BUS system. This is achieved via the loop device handler, which handles requests sent through the D-BUS interface. As two of the parameters of this handle, it receives the file descriptor list and index specifying the file where the loop device should be backed. The function itself validates the index value to ensure it isn't bigger than the maximum value allowed. However, it fails to validate the lower bound, allowing the index parameter to be a negative value. Under these circumstances, an attacker can cause the UDisks daemon to crash or perform a local privilege escalation by gaining access to files owned by privileged users."
},
{
"lang": "es",
"value": "Se encontró una falla en el demonio Udisks, donde permite a usuarios sin privilegios crear dispositivos de bucle utilizando el sistema D-BUS. Esto se logra a través del manejador de dispositivos de bucle, que maneja las solicitudes enviadas a través de la interfaz D-BUS. Como dos de los parámetros de este manejador, recibe la lista de descriptores de archivo y el índice que especifica el archivo donde el dispositivo de bucle debe ser respaldado. La función en sí valida el valor del índice para asegurar que no sea mayor que el valor máximo permitido. Sin embargo, no valida el límite inferior, permitiendo que el parámetro de índice sea un valor negativo. Bajo estas circunstancias, un atacante puede causar que el demonio UDisks falle o realizar una escalada de privilegios local al obtener acceso a archivos propiedad de usuarios privilegiados."
}
],
"lastModified": "2026-09-26T00:10:00.127",
"sourceIdentifier": "secalert@redhat.com"
}