CVE-2025-4598

Published May 30, 2025

Last updated 2 months ago

systemd-coredump

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-4598 is a race condition vulnerability found in systemd-coredump, a core dump handler present in Red Hat Enterprise Linux and Fedora. It allows a local attacker to force a SUID process to crash. The attacker can then replace it with a non-SUID binary, gaining access to the original process's privileged core dump. This access enables the attacker to read sensitive data loaded by the original process, such as contents from `/etc/shadow`, potentially exposing password hashes. The vulnerability arises because the attacker can force the Linux kernel to recycle the process ID (PID) before systemd-coredump analyzes the `/proc/pid/auxv` file, thus winning the race condition and gaining access to the core dump.

Description: A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process. A SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality.
Source: secalert@redhat.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 4.7
Impact score: 3.6
Exploitability score: 1
Vector string: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Severity: MEDIUM

Weaknesses

secalert@redhat.com: CWE-364

Hype score: Not currently trending

References