Critical Security Update for Udisks2: Out-of-Bounds Read Vulnerability
Summary
ALSA-2025:15017: Important: udisks2 security update. Affects libudisks2 versions < 2.9.0-16.el8_10.1. Fixed in 2.9.0-16.el8_10.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Udisks is a project that provides a daemon, tools, and libraries for accessing and manipulating disks and storage devices. It is widely used in Linux environments to manage storage devices efficiently. The Udisks2 package, specifically, is an essential component for handling disk operations, making it crucial for system stability and security. However, a recent vulnerability has been identified that could potentially compromise the integrity of systems utilizing this package.
Vulnerability Detail
The vulnerability, identified as CVE-2025-8067, is an out-of-bounds read in the UDisks Daemon. This flaw allows attackers to read memory beyond the intended buffer, which could lead to information disclosure or further exploitation of the system. The vulnerability arises from improper handling of memory operations within the daemon, making it critical to address promptly to prevent potential attacks.
How To Fix
Minimum fixed version
2.9.0-16.el8_10.1
This is the first release that contains the fix.
sudo dnf update libudisks2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit access to the UDisks daemon or disable it until the update is applied. This can be done by stopping the service with the command:
sudo systemctl stop udisks2.service
However, this may affect disk management functionalities.
Conclusion
The Udisks2 package has a critical vulnerability that requires immediate attention. Users are advised to update to the latest patched version to safeguard their systems. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time, ensuring ongoing security.
See every vulnerability recorded for libudisks2 →
FAQ
CVE-2025-8067 is a security vulnerability in the UDisks Daemon that allows for an out-of-bounds read, potentially leading to information disclosure.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
The risks include potential information disclosure and the possibility of further exploitation of the system by attackers.
Yes, a patch is available in version 2.9.0-16.el8_10.1 of the affected packages.
If immediate updates are not possible, consider limiting access to the UDisks daemon or disabling it temporarily to mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for libudisks2.
