Description
UDisks 2.8.0 has a format string vulnerability in udisks_log in udiskslogging.c, allowing attackers to obtain sensitive information (stack contents), cause a denial of service (memory corruption), or possibly have unspecified other impact via a malformed filesystem label, as demonstrated by %d or %n substrings.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | udisks2 | 2.8.1-1 | — |
| Debian 13 | udisks2 | 2.8.1-1 | — |
| Debian 12 | udisks2 | 2.8.1-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | udisks2 | 2.7.6-3ubuntu0.2 | USN-3772-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | udisks2 +5 | 2.7.3-9.el7 | RHSA-2019:2178 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 | udisks2 | 2.6.5-3.7.2 | SUSE-SU-2018:3278-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | udisks2 | 2.9.2-1.6 | openSUSE-SU-2024:11479-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | udisks2 +5 | 2.7.3-9.amzn2.0.1 | ALAS2-2019-1377 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | udisks2 +5 | 2.7.3-9.el7 | ELSA-2019-2178 |
Advisories 7
- WID-SEC-2022-0517 Red Hat Enterprise Linux: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 18, 2026
- RHSA-2019:2178 Red Hat Security Advisory: udisks2 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- USN-3772-1 udisks2 vulnerability Ubuntu Security Notices (USN) · Apr 22, 2026
- openSUSE-SU-2024:11479-1 libudisks2-0-2.9.2-1.6 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:3278-1 Security update for udisks2 SUSE / openSUSE Security Updates · Feb 4, 2026
- ALAS2-2019-1377 Moderate: udisks2 security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Dec 18, 2019
- ELSA-2019-2178 Moderate: udisks2 security, bug fix, and enhancement update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Aug 13, 2019
References
- https://github.com/storaged-project/udisks/issues/578
- USN-3772-1 vendor-advisory
- RHSA-2019:2178 vendor-advisory