CVE-2025-8067

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-8067
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-8067.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-8067
Downstream
Related
Published
2025-08-28T14:47:08.578Z
Modified
2026-07-08T08:12:20.416319909Z
Severity
  • 8.5 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H CVSS Calculator
Summary
Udisks: out-of-bounds read in udisks daemon
Details

A flaw was found in the Udisks daemon, where it allows unprivileged users to create loop devices using the D-BUS system. This is achieved via the loop device handler, which handles requests sent through the D-BUS interface. As two of the parameters of this handle, it receives the file descriptor list and index specifying the file where the loop device should be backed. The function itself validates the index value to ensure it isn't bigger than the maximum value allowed. However, it fails to validate the lower bound, allowing the index parameter to be a negative value. Under these circumstances, an attacker can cause the UDisks daemon to crash or perform a local privilege escalation by gaining access to files owned by privileged users.

Database specific 
{
    "cna_assigner": "redhat",
    "cwe_ids": [
        "CWE-125"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/8xxx/CVE-2025-8067.json"
}
References

Affected packages

Git / github.com/storaged-project/udisks

Affected ranges

Type
GIT
Repo
https://github.com/storaged-project/udisks
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
bc623acf9e7488dc105e4b00069d57e303e2616b
Fixed
ccef0d31684d6c57a2d75f1c790e0813be25f3a0
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.10.2"
        },
        {
            "introduced": "2.10.3"
        },
        {
            "fixed": "2.10.91"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

storaged-2.*
storaged-2.0.0
storaged-2.1.0
storaged-2.1.1
storaged-2.1.2
storaged-2.2.0
storaged-2.3.0
storaged-2.4.0
storaged-2.6.0-udisks2
storaged-2.6.2
storaged-2.6.3
udisks-2.*
udisks-2.10.0
udisks-2.10.1
udisks-2.10.90
udisks-2.6.4
udisks-2.6.5
udisks-2.7.0
udisks-2.7.1
udisks-2.7.2
udisks-2.7.3
udisks-2.7.4
udisks-2.7.5
udisks-2.7.6
udisks-2.7.7
udisks-2.8.0
udisks-2.8.1
udisks-2.8.2
udisks-2.8.3
udisks-2.8.4
udisks-2.9.0
udisks-2.9.1
udisks-2.9.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-8067.json"