银河麒麟CVE-2025-6019漏洞排查和修复

漏洞详情

Linux 系统被披露其存在本地权限提升漏洞，漏洞编号分别为CVE-2025-6018, CVE-2025-6019。可导致本地普通用户提升权限至 root 权限等危害。

CVE-2025-6018：

Linux PAM，即可插拔认证模块，是 Linux/Unix 系统的核心安全框架，用于集中管理用户认证与权限控制。

在 Linux 操作系统的 PAM（可插拔认证模块）配置中，由于系统错误地将远程 SSH 会话识别为 allow_active 用户会话，导致攻击者能以普通本地用户身份绕过权限检查，通过默认 polkit 策略执行本应仅限本地控制台用户的操作（如存储设备管理）。

CVE-2025-6019：

UDisks 是一个开源的 Linux 磁盘管理守护进程，属于主流 Linux 发行版的核心组件之一。

在大多数 Linux 操作系统中，UDisks 服务默认运行，主要提供 D-Bus 接口用于存储管理（挂载、查询、格式化等），并且在底层调用 libblockdev 库，但由于 libblockdev 库存在权限校验缺陷，导致经过身份验证的具有 allow_active 权限（可利用 Linux PAM 本地权限提升漏洞（CVE-2025-6018）获得该权限）的本地攻击者通过构造恶意存储操作请求（如伪造设备挂载）提升权限至 root 权限等。

漏洞受影响设备查看

CVE-2025-6018银河麒麟基本不受影响，CVE-2025-6019除银河麒麟桌面操作系统V10 中标麒麟高级服务器操作系统 V6 银河麒麟高级服务器操作系统 V10 以外基本都有问题，详细可见下方受影响版本链接

https://support.kylinos.cn/#/security/cveDetail?allTitle=CVE-2025-6018

https://support.kylinos.cn/#/security/cveDetail?allTitle=CVE-2025-6019

修复方法

修复升级包

https://archive.kylinos.cn/kylin/KYLIN-ALL/pool/universe/libb/libblockdev/gir1.2-blockdev-2.0_2.23-2kylin3+esm1_arm64.deb
https://archive.kylinos.cn/kylin/KYLIN-ALL/pool/universe/libb/libblockdev/libblockdev-btrfs2_2.23-2kylin3+esm1_arm64.deb
https://archive.kylinos.cn/kylin/KYLIN-ALL/pool/universe/libb/libblockdev/libblockdev-crypto2_2.23-2kylin3+esm1_arm64.deb
https://archive.kylinos.cn/kylin/KYLIN-ALL/pool/universe/libb/libblockdev/libblockdev-dm2_2.23-2kylin3+esm1_arm64.deb
https://archive.kylinos.cn/kylin/KYLIN-ALL/pool/universe/libb/libblockdev/libblockdev-fs2_2.23-2kylin3+esm1_arm64.deb
https://archive.kylinos.cn/kylin/KYLIN-ALL/pool/universe/libb/libblockdev/libblockdev-kbd2_2.23-2kylin3+esm1_arm64.deb
https://archive.kylinos.cn/kylin/KYLIN-ALL/pool/universe/libb/libblockdev/libblockdev-loop2_2.23-2kylin3+esm1_arm64.deb
https://archive.kylinos.cn/kylin/KYLIN-ALL/pool/universe/libb/libblockdev/libblockdev-lvm-dbus2_2.23-2kylin3+esm1_arm64.deb
https://archive.kylinos.cn/kylin/KYLIN-ALL/pool/universe/libb/libblockdev/libblockdev-lvm2_2.23-2kylin3+esm1_arm64.deb
https://archive.kylinos.cn/kylin/KYLIN-ALL/pool/universe/libb/libblockdev/libblockdev-mdraid2_2.23-2kylin3+esm1_arm64.deb
https://archive.kylinos.cn/kylin/KYLIN-ALL/pool/universe/libb/libblockdev/libblockdev-mpath2_2.23-2kylin3+esm1_arm64.deb
https://archive.kylinos.cn/kylin/KYLIN-ALL/pool/universe/libb/libblockdev/libblockdev-nvdimm2_2.23-2kylin3+esm1_arm64.deb
https://archive.kylinos.cn/kylin/KYLIN-ALL/pool/universe/libb/libblockdev/libblockdev-part-err2_2.23-2kylin3+esm1_arm64.deb
https://archive.kylinos.cn/kylin/KYLIN-ALL/pool/universe/libb/libblockdev/libblockdev-part2_2.23-2kylin3+esm1_arm64.deb
https://archive.kylinos.cn/kylin/KYLIN-ALL/pool/universe/libb/libblockdev/libblockdev-plugins-all_2.23-2kylin3+esm1_arm64.deb
https://archive.kylinos.cn/kylin/KYLIN-ALL/pool/universe/libb/libblockdev/libblockdev-swap2_2.23-2kylin3+esm1_arm64.deb
https://archive.kylinos.cn/kylin/KYLIN-ALL/pool/universe/libb/libblockdev/libblockdev-utils2_2.23-2kylin3+esm1_arm64.deb
https://archive.kylinos.cn/kylin/KYLIN-ALL/pool/universe/libb/libblockdev/libblockdev-vdo2_2.23-2kylin3+esm1_arm64.deb
https://archive.kylinos.cn/kylin/KYLIN-ALL/pool/universe/libb/libblockdev/libblockdev2_2.23-2kylin3+esm1_arm64.deb
https://archive.kylinos.cn/kylin/KYLIN-ALL/pool/universe/libb/libblockdev/python3-blockdev_2.23-2kylin3+esm1_all.deb

https://archive.kylinos.cn/kylin/KYLIN-ALL/pool/universe/u/udisks2/gir1.2-udisks-2.0_2.8.4-1kylin2k0.19_arm64.deb
https://archive.kylinos.cn/kylin/KYLIN-ALL/pool/universe/u/udisks2/libudisks2-0_2.8.4-1kylin2k0.19_arm64.deb
https://archive.kylinos.cn/kylin/KYLIN-ALL/pool/universe/u/udisks2/udisks2-bcache_2.8.4-1kylin2k0.19_arm64.deb
https://archive.kylinos.cn/kylin/KYLIN-ALL/pool/universe/u/udisks2/udisks2-btrfs_2.8.4-1kylin2k0.19_arm64.deb
https://archive.kylinos.cn/kylin/KYLIN-ALL/pool/universe/u/udisks2/udisks2-lvm2_2.8.4-1kylin2k0.19_arm64.deb
https://archive.kylinos.cn/kylin/KYLIN-ALL/pool/universe/u/udisks2/udisks2-vdo_2.8.4-1kylin2k0.19_arm64.deb
https://archive.kylinos.cn/kylin/KYLIN-ALL/pool/universe/u/udisks2/udisks2-zram_2.8.4-1kylin2k0.19_arm64.deb
https://archive.kylinos.cn/kylin/KYLIN-ALL/pool/universe/u/udisks2/udisks2_2.8.4-1kylin2k0.19_arm64.deb

修复方法

打开终端

按win+t 或在桌面空白处右键鼠标，选择打开终端并cd进入到升级包所在目录且所有升级包均在一个目录下

安装升级包

执行命令sudo 空格dpkg 空格 -i 空格 *.deb 执行后会提示输入密码，密码是开机密码，密码输入后不显示在屏幕上，盲输入后回车即可安装