8.5 CVE-2025-8067

Enriched by CISA Exploit
 

A flaw was found in the Udisks daemon, where it allows unprivileged users to create loop devices using the D-BUS system. This is achieved via the loop device handler, which handles requests sent through the D-BUS interface. As two of the parameters of this handle, it receives the file descriptor list and index specifying the file where the loop device should be backed. The function itself validates the index value to ensure it isn't bigger than the maximum value allowed. However, it fails to validate the lower bound, allowing the index parameter to be a negative value. Under these circumstances, an attacker can cause the UDisks daemon to crash or perform a local privilege escalation by gaining access to files owned by privileged users.
https://nvd.nist.gov/vuln/detail/CVE-2025-8067

Categories

CWE-125 : Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer. When an out-of-bounds read occurs, typically the product has already made a separate mistake, such as modifying an index or performing pointer arithmetic that produces an out-of-bounds address. Shorthand for "Out of bounds" read Fuzz testing (fuzzing) is a powerful technique for generating large numbers of diverse inputs - either randomly or algorithmically - and dynamically invoking the code with those inputs. Even with random inputs, it is often capable of generating unexpected results such as crashes, memory corruption, or resource consumption. Fuzzing effectively produces repeatable test cases that clearly indicate bugs, which helps developers to diagnose the issues. Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.) Use tools that are integrated duringcompilation to insert runtime error-checking mechanismsrelated to memory safety errors, such as AddressSanitizer(ASan) for C/C++ [REF-1518]. Use a language that provides appropriate memory abstractions. The reference implementation code for a Trusted Platform Module does not implement length checks on data, allowing for an attacker to read 2 bytes past the end of a buffer. Out-of-bounds read in IP stack used in embedded systems, as exploited in the wild per CISA KEV. Chain: "Heartbleed" bug receives an inconsistent length parameter (CWE-130) enabling an out-of-bounds read (CWE-126), returning memory that could include private cryptographic keys and other sensitive data. HTML conversion package has a buffer under-read, allowing a crash Chain: unexpected sign extension (CWE-194) leads to integer overflow (CWE-190), causing an out-of-bounds read (CWE-125) Chain: product does not handle when an input string is not NULL terminated (CWE-170), leading to buffer over-read (CWE-125) or heap-based buffer overflow (CWE-122). Chain: series of floating-point precision errors(CWE-1339) in a web browser rendering engine causes out-of-bounds read(CWE-125), giving access to cross-origin data out-of-bounds read due to improper length check packet with large number of specified elements cause out-of-bounds read. packet with large number of specified elements cause out-of-bounds read. out-of-bounds read, resultant from integer underflow large length value causes out-of-bounds read malformed image causes out-of-bounds read OS kernel trusts userland-supplied length value, allowing reading of sensitive information

References


 

AFFECTED (from MITRE)

Vendor Product Versions
storaged-project udisks
  • < 2.10.2 [affected]
  • 2.10.3 < 2.10.91 [affected]
Red Hat Red Hat Enterprise Linux 10
  • 0:2.10.90-5.el10_0.1 < * [unaffected]
Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support
  • 0:2.8.4-1.el7_9.2 < * [unaffected]
Red Hat Red Hat Enterprise Linux 8
  • 0:2.9.0-16.el8_10.1 < * [unaffected]
Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support
  • 0:2.8.3-2.el8_2.1 < * [unaffected]
Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  • 0:2.9.0-6.el8_4.1 < * [unaffected]
Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
  • 0:2.9.0-6.el8_4.1 < * [unaffected]
Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  • 0:2.9.0-9.el8_6.1 < * [unaffected]
Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service
  • 0:2.9.0-9.el8_6.1 < * [unaffected]
Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  • 0:2.9.0-9.el8_6.1 < * [unaffected]
Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
  • 0:2.9.0-13.el8_8.1 < * [unaffected]
Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  • 0:2.9.0-13.el8_8.1 < * [unaffected]
Red Hat Red Hat Enterprise Linux 9
  • 0:2.9.4-11.el9_6.1 < * [unaffected]
Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
  • 0:2.9.4-3.el9_0.2 < * [unaffected]
Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  • 0:2.9.4-7.el9_2.2 < * [unaffected]
Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support
  • 0:2.9.4-10.el9_4.2 < * [unaffected]
Red Hat Red Hat Enterprise Linux 6
    © 2022 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.

    CPE

    cpe start end

    REMEDIATION


    EXPLOITS

    Exploit-db.com

    id description date
    No known exploits

    POC Github

    Url
    https://github.com/born0monday/CVE-2025-8067

    Other Nist (github, ...)

    Url
    No known exploits

    CAPEC

    Common Attack Pattern Enumerations and Classifications

    id description severity
    540 Overread Buffers
    		High