+++ This bug was initially created as a clone of Bug #2373301 +++ The Qualys team discovered [a] LPE vulnerability in libblockdev, trivially exploitable via the udisks daemon, which is installed by default on most Linux distributions: an "allow_active" user (e.g., a physical user, or an attacker who hijacked the session of a physical user) can obtain the full privileges of the root user [1]. [1] https://www.openwall.com/lists/oss-security/2025/06/17/4 Reproducible: Always Actual Results: LPE Expected Results: Disallow LPE. Additional Information: Proposed patches for both udisks and libblockdev [1]. [1] https://www.openwall.com/lists/oss-security/2025/06/17/5
FEDORA-2025-af7ba2696c (libblockdev-3.3.1-1.fc42) has been submitted as an update to Fedora 42. https://bodhi.fedoraproject.org/updates/FEDORA-2025-af7ba2696c
FEDORA-2025-4f28b95d7e (libblockdev-3.2.2-1.fc41) has been submitted as an update to Fedora 41. https://bodhi.fedoraproject.org/updates/FEDORA-2025-4f28b95d7e
FEDORA-2025-af7ba2696c has been pushed to the Fedora 42 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-af7ba2696c` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-af7ba2696c See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2025-4f28b95d7e has been pushed to the Fedora 41 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-4f28b95d7e` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-4f28b95d7e See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2025-af7ba2696c (libblockdev-3.3.1-1.fc42) has been pushed to the Fedora 42 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-2025-4f28b95d7e (libblockdev-3.2.2-1.fc41) has been pushed to the Fedora 41 stable repository. If problem still persists, please make note of it in this bug report.