CVE-2025-66004: usbmuxd Path Traversal Privilege Escalation

CVE-2025-66004 Overview

CVE-2025-66004 is a path traversal vulnerability in usbmuxd, the USB multiplexing daemon used to communicate with Apple iOS devices over USB on Linux systems. The flaw allows a local user to escalate privileges to the usbmux service account. The vulnerability is tracked under CWE-35: Path Traversal: '.../...//' and is fixed in commit 3ded00c9985a5108cfc7591a309f9a23d57a8cba. Advisories have been published by both SUSE and Debian LTS.

Critical Impact
A local attacker can traverse directory paths handled by usbmuxd to gain the privileges of the service user, bypassing intended access controls on the host.

Affected Products

usbmuxd versions prior to commit 3ded00c9985a5108cfc7591a309f9a23d57a8cba
Debian LTS distributions shipping vulnerable usbmuxd packages
SUSE Linux distributions shipping vulnerable usbmuxd packages

Discovery Timeline

2025-12-10 - CVE-2025-66004 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2025-66004

Vulnerability Analysis

usbmuxd is a daemon that brokers communication between host applications and Apple mobile devices connected over USB. It runs under a dedicated service account and manages socket paths and pairing records on the local filesystem. The vulnerability stems from insufficient validation of path components supplied through local inputs, enabling traversal outside the intended working directories.

An attacker with local access can craft a path containing traversal sequences that usbmuxd resolves without proper canonicalization. This allows the attacker to influence files or sockets outside the daemon's intended scope while operating under the service's identity. The attack requires only local access and does not require user interaction.

Root Cause

The root cause is improper neutralization of relative path sequences such as ../ within filename or path arguments processed by usbmuxd. This matches the pattern described by CWE-35, where multiple traversal patterns bypass naive sanitization. The upstream fix in commit 3ded00c9985a5108cfc7591a309f9a23d57a8cba introduces stricter path handling to prevent escape from the designated directory.

Attack Vector

Exploitation requires local access to a host running a vulnerable usbmuxd instance. The attacker supplies crafted path input to the daemon, which processes it with service privileges. Success yields integrity and availability impact at the service-user level, which can be chained with other weaknesses to broaden impact.

No public proof-of-concept exploit has been published. Technical details are available in the SUSE Bug Report and the Debian LTS Announcement.

Detection Methods for CVE-2025-66004

Indicators of Compromise

Unexpected files or sockets created outside the standard usbmuxd runtime directory, typically /var/run/usbmuxd or /var/lib/lockdown.
Modifications to files owned by the usbmux service account that cannot be attributed to package updates or legitimate device pairing.
Local process arguments passed to usbmuxd containing ../ sequences or encoded traversal patterns.

Detection Strategies

Audit filesystem access by the usbmuxd process using Linux audit rules on the service's working directories.
Inventory installed usbmuxd package versions across Linux endpoints and flag versions predating the fix commit.
Review system logs for usbmuxd restarts, crashes, or anomalous socket creations correlated with non-root local activity.

Monitoring Recommendations

Enable auditd rules watching paths touched by the usbmux user, including writes outside the daemon's expected directories.
Monitor process creation events for local users invoking usbmuxd client utilities with unusual argument patterns.
Alert on privilege transitions where processes assume the usbmux service identity through unexpected parent processes.

How to Mitigate CVE-2025-66004

Immediate Actions Required

Apply the vendor-supplied usbmuxd update from your Linux distribution's security repository.
Confirm installed packages include the fix at or after upstream commit 3ded00c9985a5108cfc7591a309f9a23d57a8cba.
Restrict local, interactive access to systems running usbmuxd to trusted administrators only.

Patch Information

The upstream fix is included in usbmuxd commit 3ded00c9985a5108cfc7591a309f9a23d57a8cba. Distribution-specific updates are tracked in the SUSE Bug Report and the Debian LTS Announcement. Administrators should install the patched package through their standard update channels and restart the usbmuxd service.

Workarounds

Stop and disable the usbmuxd service on hosts that do not require Apple device connectivity using systemctl disable --now usbmuxd.
Remove the usbmuxd package where USB iOS device management is not a business requirement.
Restrict membership of any group granting access to usbmuxd sockets to a minimal set of administrators.

bash

# Verify package version and apply vendor update
dpkg -l | grep usbmuxd            # Debian/Ubuntu
rpm -q usbmuxd                     # SUSE/RHEL

# Apply security updates
sudo apt update && sudo apt install --only-upgrade usbmuxd    # Debian LTS
sudo zypper patch                                              # SUSE

# Restart the service after patching
sudo systemctl restart usbmuxd
sudo systemctl status usbmuxd