gir1.2-udisks-2.0: A flaw was found in the Udisks daemon, where it allows unprivileged usersto create loop devices using the D-BUS system

A flaw was found in the Udisks daemon, where it allows unprivileged usersto create loop devices using the D-BUS system. This is achieved via theloop device handler, which handles requests sent through the D-BUSinterface. As two of the parameters of this handle, it receives the filedescriptor list and index specifying the file where the loop device shouldbe backed. The function itself validates the index value to ensure it isn'tbigger than the maximum value allowed. However, it fails to validate thelower bound, allowing the index parameter to be a negative value. Underthese circumstances, an attacker can cause the UDisks daemon to crash orperform a local privilege escalation by gaining access to files owned byprivileged users.

Where it's fixed