Summary
Michael Imfeld discovered that UDisks did not check the validity of input
data correctly when handling files for loop devices. An attacker could
possibly use this issue to cause a denial of service or execute arbitrary
code.
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | udisks2 | 2.9.4-1ubuntu2.3 |
| Ubuntu · 24.04 LTS 24.04:LTS | udisks2 | 2.10.1-6ubuntu1.3 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | udisks2 | 2.1.3-1ubuntu0.1+esm1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | udisks2 | 2.1.7-1ubuntu1+esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | udisks2 | 2.7.6-3ubuntu0.2+esm2 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | udisks2 | 2.8.4-1ubuntu2+esm2 |
Vulnerabilities 1
-
High 8.5CVE-2025-8067 Public exploit
Udisks: out-of-bounds read in udisks daemon
A flaw was found in the Udisks daemon, where it allows unprivileged users to create loop devices using the D-BUS system. This is achieved via the loop device handler, which handles requests sent through the D-BUS interface. As two of the parameters of this ha…
References
-
report
https://ubuntu.com/security/CVE-2025-8067