Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Imported from Jira PSIRTSUPT-7383.
Reporter (Jira): Azizcan Dastan

--- Description ---
udisks2: LPE via as-user option spoofing in Filesystem.Mount

The org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method accepts an "as-user" option that instructs the udisks daemon to mount a filesystem on behalf of a specified user rather than the calling user. This changes the mount path (typically under /run/media/$USER/) and grants the specified user unmount privileges.

Insufficient authorization checking on the "as-user" option allows a local attacker with an active console session to spoof the as-user parameter, mounting filesystems on behalf of arbitrary users including privileged accounts. This can be used to:

1. Mount attacker-controlled filesystem content under a target user's media directory
2. Manipulate the mount namespace visible to privileged users
3. Achieve local privilege escalation through mount point injection

The vulnerability requires local D-Bus access (typically an active logind session with allow_active authorization) but does not require administrative privileges to exploit.

Affected: udisks2 (storaged-project/udisks) - versions with as-user mount option support.

This is an embargoed vulnerability reported via Red Hat PSIRT JSM queue.