CyberRota Analysis
AI-GeneratedA vulnerability in udisks2 allows local attackers with an active console session to exploit insufficient authorization checks in the D-Bus method for mounting filesystems. By spoofing the 'as-user' parameter, attackers can mount filesystems on behalf of any user, including privileged accounts, potentially leading to local privilege escalation and manipulation of the mount namespace. Organizations using udisks2 should prioritize patching this flaw to mitigate the risk of unauthorized access and privilege escalation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on behalf of arbitrary users, including privileged accounts. This can lead to local privilege escalation through mount point injection and manipulation of the mount namespace visible to privileged users.