CVE-2025-4598

Summary

A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process.

A SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality.

Affected Software

VendorProductVersion RangeStatus
0 < 252.37affected
253.0 < 253.32affected
254.0 < 254.25affected
255.0 < 255.19affected
256.0 < 256.14affected
257.0 < 257.6affected
Red HatRed Hat Enterprise Linux 100:257-23.el10 < *unaffected
Red HatRed Hat Enterprise Linux 90:252-55.el9_7.7 < *unaffected
Red HatRed Hat Enterprise Linux 90:252-55.el9_7.7 < *unaffected
Red HatRed Hat Ceph Storage 77 < *unaffected
Red HatRed Hat Ceph Storage 88 < *unaffected
Red HatRed Hat Ceph Storage 81769512383 < *unaffected
Red HatRed Hat Discovery 21767888970 < *unaffected
Red HatRed Hat Discovery 21767904573 < *unaffected
Red HatRed Hat Insights proxy 1.51.5.9-1765201856 < *unaffected

Weaknesses

  • CWE-364: Signal Handler Race Condition

Workarounds

This issue can be mitigated by disabling the capability of the system to generate a coredump for SUID binaries. The perform that, the following command can be ran as root user:

echo 0 &gt; /proc/sys/fs/suid_dumpable

While this mitigates this vulnerability while it's not possible to update the systemd package, it disables the capability of analyzing crashes for such binaries.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: no
    • Technical Impact: partial

CVE Program Container

Additional References

Additional References

References