A flaw was found in the udisks storage management daemon that allows unprivileged users to back up LUKS encryption headers without authorization. The issue occurs because a privileged D-Bus method responsible for exporting encryption metadata does not perform a policy check. As a result, sensitive cryptographic metadata can be read and written to attacker-controlled locations. This weakens the confidentiality guarantees of encrypted storage volumes.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Oracle_linux | — | Upgrade udisks2-lvm2Upgrade libudisks2-develUpgrade udisks2-lsmUpgrade libudisks2Upgrade udisks2Upgrade udisks2-iscsi | Mar 3, 2026 | Feb 25, 2026 |
| Redhat_linux | — | Upgrade udisks2-lsmUpgrade udisks2-debuginfoUpgrade udisks2-lsm-debuginfoUpgrade udisks2-lvm2-debuginfoUpgrade libudisks2-develUpgrade udisks2-iscsi-debuginfoUpgrade udisks2-iscsiUpgrade libudisks2Upgrade udisks2-debugsourceUpgrade udisks2Upgrade udisks2-lvm2Upgrade libudisks2-debuginfo | Mar 3, 2026 | Feb 25, 2026 |
| Rocky_linux | — | Upgrade udisks2-debuginfoUpgrade libudisks2Upgrade udisks2-debugsourceUpgrade udisks2-iscsiUpgrade udisks2-lsm-debuginfoUpgrade udisks2-iscsi-debuginfoUpgrade libudisks2-debuginfoUpgrade udisks2-lvm2-debuginfoUpgrade libudisks2-develUpgrade udisks2-lsmUpgrade udisks2-lvm2Upgrade udisks2 | Mar 9, 2026 | Mar 5, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub