VIR Vulnerability Intelligence Relay

CVE-2025-4598

medium
Published 2025-12-03 · Modified 2026-06-02
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
4.7
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4 NEW
—
not yet in upstream
VIR risk
4.7

Description

A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process. A SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality.

Predictions

Exploit likelihood
47%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

Mitigation details

Source: Red Hat Errata — Red Hat Inc. · View original ↗ · Open-Errata-API

Description systemd-coredump: race condition that allows a local attacker to crash a SUID program and gain read access to the resulting core dump Red Hat statement This flaw was rated as having a severity of Moderate due to the complexity to exploit this flaw. The attacker needs to setup a way to win the race condition and have an unprivileged local account to successfully exploit this…

Description

systemd-coredump: race condition that allows a local attacker to crash a SUID program and gain read access to the resulting core dump

Red Hat statement

This flaw was rated as having a severity of Moderate due to the complexity to exploit this flaw. The attacker needs to setup a way to win the race condition and have an unprivileged local account to successfully exploit this vulnerability. By default Red Hat Enterprise Linux 8 doesn't allow systemd-coredump to create dumps of SUID programs as the /proc/sys/fs/suid_dumpable is set to 0, disabling by default this capability.

CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)

Errata / fixed releases

ProductPackageAdvisoryReleased
Red Hat Enterprise Linux 10systemd-0:257-23.el10RHSA-2026:181532026-05-19T00:00:00Z
Red Hat Enterprise Linux 9systemd-0:252-55.el9_7.7RHSA-2025:226602025-12-03T00:00:00Z
Red Hat Enterprise Linux 9systemd-0:252-55.el9_7.7RHSA-2025:226602025-12-03T00:00:00Z
Red Hat Ceph Storage 7rhceph/rhceph-7-rhel9:7RHSA-2025:232342025-12-16T00:00:00Z
Red Hat Ceph Storage 8rhceph/rhceph-8-rhel9:8RHSA-2025:232272025-12-16T00:00:00Z
Red Hat Ceph Storage 8rhceph/rhceph-8-rhel9:1769512383RHSA-2026:16522026-02-02T00:00:00Z
Red Hat Discovery 2discovery/discovery-server-rhel9:1767888970RHSA-2026:04142026-01-08T00:00:00Z
Red Hat Discovery 2discovery/discovery-ui-rhel9:1767904573RHSA-2026:04142026-01-08T00:00:00Z
Red Hat Insights proxy 1.5insights-proxy/insights-proxy-container-rhel9:1.5.9-1765201856RHSA-2025:228682025-12-08T00:00:00Z

Package state

ProductPackageState
Red Hat Enterprise Linux 10NetworkManagerNot affected
Red Hat Enterprise Linux 10rpm-ostreeAffected
Red Hat Enterprise Linux 7NetworkManagerNot affected
Red Hat Enterprise Linux 7systemdFix deferred
Red Hat Enterprise Linux 8systemdFix deferred
Red Hat Enterprise Linux 9NetworkManagerNot affected
Red Hat OpenShift Container Platform 4rhcosAffected
Red Hat OpenShift Container Platform 4systemdNot affected

Apply commands

bash fix
Apply RHSA-2026:18153 for Red Hat Enterprise Linux 10
yum update -y systemd
# or:
dnf upgrade -y systemd

Affected

VendorProductVersion
redhatRed Hat Enterprise Linux 10Not affected
redhatRed Hat Enterprise Linux 10Affected
redhatRed Hat Enterprise Linux 7Not affected
redhatRed Hat Enterprise Linux 9Not affected
redhatRed Hat OpenShift Container Platform 4Affected
redhatRed Hat OpenShift Container Platform 4Not affected

OS impact
arch Arch Affected 1 release
VersionStatusFixed in
— Affected —
linux Linux kernel Affected 1 release
VersionStatusFixed in
— Affected 6.16
suse SUSE Affected 1 release
VersionStatusFixed in
— Affected —
debian Debian Mixed 7 releases
VersionStatusFixed in
trixie Fixed 257.6-1
sid Fixed 257.6-1
forky Fixed 257.6-1
bullseye Fixed 247.3-7+deb11u7
bookworm Fixed 252.38-1~deb12u1
12.0 Affected —
11.0 Affected —
redhat Red Hat Mixed 5 releases
VersionStatusFixed in
10.0 Affected —
9.0 Affected —
9 Fixed —
8.0 Affected —
7.0 Affected —
almalinux AlmaLinux Fixed 1 release
VersionStatusFixed in
9 Fixed systemd-journal-remote-252-55.el9_7.7.alma.1.aarch64.rpm

Application impact
VendorProductVersionsFixed
systemd_projectsystemd{"endExcluding":"252.37"}252.37
redhat redhatopenshift_container_platform4.0

References

CWEs

CWE-364

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.