Critical Security Update for Udisks2: Out-of-Bounds Read Vulnerability
Summary
ALSA-2025:15018: Important: udisks2 security update. Affects libudisks2 versions < 2.9.4-11.el9_6.1. Fixed in 2.9.4-11.el9_6.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Udisks2 is a project that provides a daemon, tools, and libraries for accessing and manipulating disks, storage devices, and related technologies. It is widely used in Linux environments to manage storage devices efficiently. The recent vulnerability affects multiple packages within the Udisks2 ecosystem, including libudisks2, libudisks2-devel, udisks2, and related components, making it crucial for users to address this issue promptly.
Vulnerability Detail
The vulnerability identified as CVE-2025-8067 is an out-of-bounds read in the UDisks Daemon. This flaw could allow an attacker to read memory outside the intended buffer, potentially leading to information disclosure or other malicious actions. The vulnerability arises from improper handling of memory access within the daemon, which could be exploited if an attacker has access to the system running Udisks2.
How To Fix
Minimum fixed version
2.9.4-11.el9_6.1
This is the first release that contains the fix.
sudo dnf update libudisks2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is strongly recommended to apply the security update as soon as possible to mitigate any potential risks.
Conclusion
The Udisks2 security update addresses a critical out-of-bounds read vulnerability that could pose significant risks to systems utilizing this software. Users are strongly encouraged to update their packages to the patched version to ensure their systems remain secure.
See every vulnerability recorded for libudisks2 →
FAQ
CVE-2025-8067 is a security vulnerability in the UDisks Daemon that allows for an out-of-bounds read, which could lead to information disclosure.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
While there are no specific workarounds, it is advisable to limit access to the affected system until the update can be applied.
Failing to address this vulnerability may expose your system to potential attacks that could lead to unauthorized access or data leakage.
For more details, refer to the CVE page associated with CVE-2025-8067 or the advisory provided by AlmaLinux.
Related vulnerabilities
Recent vulnerabilities recorded for libudisks2.
