CVE-2025-8067
Status: DeferredHigh (8.5)—
A flaw was found in the Udisks daemon, where it allows unprivileged users to create loop devices using the D-BUS system. This is achieved via the loop device handler, which handles requests sent through the D-BUS interface. As two of the parameters of this handle, it receives the file descriptor list and index specifying the file where the loop device should be backed. The function itself validates the index value to ensure it isn't bigger than the maximum value allowed. However, it fails to validate the lower bound, allowing the index parameter to be a negative value. Under these circumstances, an attacker can cause the UDisks daemon to crash or perform a local privilege escalation by gaining access to files owned by privileged users.
CVSS
- Version: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H
- Base score: 8.5
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 0.65%
- Percentile among all scored CVEs: 50
- Score date: 10/6/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
🎯 ATT&CK techniques
How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.
- Exploitation
T1068Exploitation for Privilege Escalationprivilege escalation90 % - Secondary impact
T1499.004Application or System Exploitationimpact80 %
AV:L (acceso local sin privilegios) sin interacción de usuario indica escalada. El índice negativo en dbus permite crash de daemon (DoS) o acceso a archivos privilegiados; ejecución de código o comandos con permisos elevados.
Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.
🛡️ ATT&CK mitigations that cover these techniques
Affected technologies (1)
⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.
CWEs
- CWE-125
References
- https://access.redhat.com/errata/RHSA-2025:15017
- https://access.redhat.com/errata/RHSA-2025:15018
- https://access.redhat.com/errata/RHSA-2025:15020
- https://access.redhat.com/errata/RHSA-2025:15956
- https://access.redhat.com/errata/RHSA-2025:16021
- https://access.redhat.com/errata/RHSA-2025:16090
- https://access.redhat.com/errata/RHSA-2025:16106
- https://access.redhat.com/errata/RHSA-2025:16121
- https://access.redhat.com/errata/RHSA-2025:16122
- https://access.redhat.com/errata/RHSA-2025:16125
- https://access.redhat.com/errata/RHSA-2025:16130
- https://access.redhat.com/security/cve/CVE-2025-8067
- https://bugzilla.redhat.com/show_bug.cgi?id=2388623
- http://www.openwall.com/lists/oss-security/2025/08/28/1
- https://lists.debian.org/debian-lts-announce/2025/08/msg00023.html
Raw JSON (NVD)
Show
{
"id": "CVE-2025-8067",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2025-8067",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2025-08-28T16:20:49.738181Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "secalert@redhat.com",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 8.5,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H",
"integrityImpact": "LOW",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "LOW"
},
"impactScore": 5.3,
"exploitabilityScore": 2.5
}
]
},
"affected": [
{
"source": "secalert@redhat.com",
"affectedData": [
{
"vendor": "storaged-project",
"product": "udisks",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "2.10.2",
"versionType": "semver"
},
{
"status": "affected",
"version": "2.10.3",
"lessThan": "2.10.91",
"versionType": "semver"
}
],
"packageName": "udisks2",
"collectionURL": "https://github.com/storaged-project/udisks",
"defaultStatus": "unaffected"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.0"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"versions": [
{
"status": "unaffected",
"version": "0:2.10.90-5.el10_0.1",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "udisks2",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/o:redhat:rhel_els:7"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
"versions": [
{
"status": "unaffected",
"version": "0:2.8.4-1.el7_9.2",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "udisks2",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::appstream",
"cpe:/a:redhat:enterprise_linux:8::crb"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"versions": [
{
"status": "unaffected",
"version": "0:2.9.0-16.el8_10.1",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "udisks2",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_aus:8.2::appstream"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.2 Advanced Update Support",
"versions": [
{
"status": "unaffected",
"version": "0:2.8.3-2.el8_2.1",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "udisks2",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_aus:8.4::appstream",
"cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
"versions": [
{
"status": "unaffected",
"version": "0:2.9.0-6.el8_4.1",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "udisks2",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_aus:8.4::appstream",
"cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
"versions": [
{
"status": "unaffected",
"version": "0:2.9.0-6.el8_4.1",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "udisks2",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_aus:8.6::appstream",
"cpe:/a:redhat:rhel_e4s:8.6::appstream",
"cpe:/a:redhat:rhel_tus:8.6::appstream"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
"versions": [
{
"status": "unaffected",
"version": "0:2.9.0-9.el8_6.1",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "udisks2",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_aus:8.6::appstream",
"cpe:/a:redhat:rhel_e4s:8.6::appstream",
"cpe:/a:redhat:rhel_tus:8.6::appstream"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
"versions": [
{
"status": "unaffected",
"version": "0:2.9.0-9.el8_6.1",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "udisks2",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_aus:8.6::appstream",
"cpe:/a:redhat:rhel_e4s:8.6::appstream",
"cpe:/a:redhat:rhel_tus:8.6::appstream"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
"versions": [
{
"status": "unaffected",
"version": "0:2.9.0-9.el8_6.1",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "udisks2",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.8::appstream",
"cpe:/a:redhat:rhel_tus:8.8::appstream"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
"versions": [
{
"status": "unaffected",
"version": "0:2.9.0-13.el8_8.1",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "udisks2",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.8::appstream",
"cpe:/a:redhat:rhel_tus:8.8::appstream"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"versions": [
{
"status": "unaffected",
"version": "0:2.9.0-13.el8_8.1",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "udisks2",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/a:redhat:enterprise_linux:9::crb"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"versions": [
{
"status": "unaffected",
"version": "0:2.9.4-11.el9_6.1",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "udisks2",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.0::appstream"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
"versions": [
{
"status": "unaffected",
"version": "0:2.9.4-3.el9_0.2",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "udisks2",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2::appstream"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"versions": [
{
"status": "unaffected",
"version": "0:2.9.4-7.el9_2.2",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "udisks2",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_eus:9.4::appstream",
"cpe:/a:redhat:rhel_eus:9.4::crb"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
"versions": [
{
"status": "unaffected",
"version": "0:2.9.4-10.el9_4.2",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "udisks2",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
"packageName": "udisks",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unknown"
}
]
}
],
"published": "2025-08-28T15:16:03.600",
"references": [
{
"url": "https://access.redhat.com/errata/RHSA-2025:15017",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:15018",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:15020",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:15956",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:16021",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:16090",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:16106",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:16121",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:16122",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:16125",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:16130",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-8067",
"source": "secalert@redhat.com"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2388623",
"source": "secalert@redhat.com"
},
{
"url": "http://www.openwall.com/lists/oss-security/2025/08/28/1",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00023.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Deferred",
"weaknesses": [
{
"type": "Secondary",
"source": "secalert@redhat.com",
"description": [
{
"lang": "en",
"value": "CWE-125"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Udisks daemon, where it allows unprivileged users to create loop devices using the D-BUS system. This is achieved via the loop device handler, which handles requests sent through the D-BUS interface. As two of the parameters of this handle, it receives the file descriptor list and index specifying the file where the loop device should be backed. The function itself validates the index value to ensure it isn't bigger than the maximum value allowed. However, it fails to validate the lower bound, allowing the index parameter to be a negative value. Under these circumstances, an attacker can cause the UDisks daemon to crash or perform a local privilege escalation by gaining access to files owned by privileged users."
},
{
"lang": "es",
"value": "Se encontró una falla en el demonio Udisks, donde permite a usuarios sin privilegios crear dispositivos de bucle utilizando el sistema D-BUS. Esto se logra a través del manejador de dispositivos de bucle, que maneja las solicitudes enviadas a través de la interfaz D-BUS. Como dos de los parámetros de este manejador, recibe la lista de descriptores de archivo y el índice que especifica el archivo donde el dispositivo de bucle debe ser respaldado. La función en sí valida el valor del índice para asegurar que no sea mayor que el valor máximo permitido. Sin embargo, no valida el límite inferior, permitiendo que el parámetro de índice sea un valor negativo. Bajo estas circunstancias, un atacante puede causar que el demonio UDisks falle o realizar una escalada de privilegios local al obtener acceso a archivos propiedad de usuarios privilegiados."
}
],
"lastModified": "2026-09-26T00:10:00.127",
"sourceIdentifier": "secalert@redhat.com"
}