Critical Security Flaw in Udisks2: Unprivileged Access to LUKS Headers
Summary
ALSA-2026:3476: Important: udisks2 security update. Affects libudisks2 versions < 2.10.90-6.el10_1.1.alma.1. Fixed in 2.10.90-6.el10_1.1.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Udisks2 is a project that provides a daemon, tools, and libraries for accessing and manipulating disks and storage devices. It is widely used in Linux environments to manage disk partitions and storage technologies. The package is essential for operations involving disk management, making it a critical component in many systems. However, it has recently been found to have vulnerabilities that could allow unauthorized access to sensitive data.
Vulnerability Detail
The vulnerabilities identified in Udisks2 stem from missing authorization checks in its D-Bus API. Specifically, unprivileged users can exploit these flaws to back up and restore LUKS (Linux Unified Key Setup) headers without proper authorization. This could lead to unauthorized access to encrypted data, posing a significant security risk to systems relying on LUKS for disk encryption.
How To Fix
Minimum fixed version
2.10.90-6.el10_1.1.alma.1
This is the first release that contains the fix.
sudo dnf update libudisks2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, system administrators can restrict access to the D-Bus API for Udisks2 to prevent unprivileged users from exploiting these vulnerabilities. This can be done by modifying the D-Bus configuration files to limit access permissions.
Conclusion
The vulnerabilities in Udisks2 present a serious risk due to the lack of authorization checks in its D-Bus API, allowing unprivileged users to access sensitive LUKS headers. It is crucial for users to update their packages to the patched version to mitigate these risks and protect their data.
See every vulnerability recorded for libudisks2 →
FAQ
Udisks2 is a daemon and set of tools for managing disks and storage devices in Linux environments.
The vulnerabilities allow unprivileged users to back up and restore LUKS headers via the D-Bus API without proper authorization.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
Consider implementing access restrictions to the D-Bus API as a temporary workaround until you can apply the updates.
While the vulnerability does not directly cause data loss, it does expose sensitive encrypted data to unauthorized users, which can lead to significant security breaches.
Related vulnerabilities
Recent vulnerabilities recorded for libudisks2.
