Critical Vulnerability in libblockdev: Local Privilege Escalation via udisks
Summary
RLSA-2025:9327: Important: libblockdev security update. Affects libblockdev versions < 0:2.28-14.el9_6. Fixed in 0:2.28-14.el9_6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libblockdev is a C library that provides GObject introspection support for low-level operations on block devices. It acts as a thin wrapper around various plug-ins that offer specific functionalities, including LVM, Btrfs, LUKS, and MD RAID. This library is integral for managing block devices in a Linux environment, making it a crucial component for system administrators and developers alike. However, it has been identified to have a significant security vulnerability that could lead to unauthorized access.
Vulnerability Detail
The vulnerability identified as CVE-2025-6019 allows for local privilege escalation (LPE) from an active user to root privileges through the libblockdev library via udisks. This flaw could potentially allow an attacker with local access to exploit the library and gain elevated privileges, leading to unauthorized access to sensitive system resources. The CVSS score for this vulnerability is 7.0, indicating a high severity level that necessitates immediate attention.
How To Fix
Minimum fixed version
0:2.28-14.el9_6
This is the first release that contains the fix.
sudo dnf update libblockdevTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit access to the affected functionality of libblockdev until the package is updated. This can be done by modifying user permissions or restricting access to the udisks service.
Conclusion
The libblockdev library has a critical vulnerability (CVE-2025-6019) that allows local privilege escalation. It is essential to update to the patched version to secure your system against potential exploitation. Implementing temporary workarounds may help mitigate risks until an update can be applied.
See every vulnerability recorded for libblockdev →
FAQ
CVE-2025-6019 is a vulnerability in the libblockdev library that allows local privilege escalation from an active user to root privileges.
If exploited, this vulnerability can allow an attacker with local access to gain root privileges, potentially compromising the entire system.
You should implement temporary workarounds such as restricting access to the udisks service or modifying user permissions.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in software using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for libblockdev.
