PT-2025-23285 · Systemd+9 · Systemd-Coredump+10
David Fernandez Gonzalez
·
Published
2025-01-01
·
Updated
2026-05-19
·
CVE-2025-4598
CVSS v3.1
4.7
Medium
| Vector | AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
systemd-coredump (affected versions not specified)
systemd versions prior to 252.38-1~deb12u1
Description
A flaw in systemd-coredump allows an attacker to force a SUID process to crash and replace it with a non-SUID binary, giving access to the original's privileged process coredump and allowing the attacker to read sensitive data. This is achieved by winning a race condition, where the attacker forces the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. The attacker can then read sensitive content loaded into memory by the original binary, affecting data confidentiality.
Recommendations
For versions prior to 252.38-1deb12u1, upgrade the systemd packages to version 252.38-1deb12u1 or later.
As a temporary workaround, consider restricting access to SUID processes to minimize the risk of exploitation.
Avoid using the
core pattern variable in /proc/sys/kernel/core pattern until the issue is resolved.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Debian
Linuxmint
Red Hat
Rocky Linux
Suse
Ubuntu
Systemd
Systemd-Coredump