Qualys TRU Uncovers Chained LPE: SUSE 15 PAM to Full Root via libblockdev/udisks | Qualys
Summary: Qualys TRU found two linked local privilege escalation flaws: CVE-2025-6018, a PAM misconfiguration in openSUSE Leap 15 and SUSE Linux Enterprise 15 that lets an unprivileged local user such as an SSH session reach the "allow_active" context, and CVE-2025-6019, a libblockdev flaw reachable through the udisks daemon that turns allow_active into full root. Qualys built proof-of-concept exploits and targeted the libblockdev/udisks flaw successfully on Ubuntu, Debian, Fedora, and openSUSE Leap 15.
What's compelling: udisks ships by default on almost all Linux distributions, so chaining these two built-in packages lets any SSH user on SUSE 15/Leap 15 go from normal login to root, and root access lets an intruder unload EDR agents, implant kernel-level backdoors, and use the server as a launchpad for lateral movement across the fleet.
Read the original at Qualys Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-6018CVE-2025-6019
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026