CVE-2025-4598
MediumCVSS 4.7Exploitation Probability (EPSS)
Elevated risk55th percentile - higher than 55% of all known CVEs
Summary
A vulnerability in systemd-coredump allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump. This enables reading sensitive data, such as /etc/shadow content, loaded by the original process.
Risk Assessment
The risk involves potential leakage of sensitive system data, including user passwords, which could lead to privilege escalation and system compromise.
Recommendation
Immediately update systemd to a patched version that fixes the race condition in /proc/pid/auxv analysis. Until patched, restrict access to SUID processes and monitor for unusual crashes.
Other vulnerabilities in systemd
See all- CVE-2017-15908High
In systemd versions 223 through 235, a remote DNS server can respond with a custom crafted NSEC resource record to trigger an infinite loop in the dns_packet_read_type_window() function of the 'systemd-resolved' service, causing a DoS of the affected service.
- CVE-2017-9445High
In systemd versions up to 233, certain sizes passed to dns_packet_new in systemd-resolved can cause it to allocate a buffer that's too small. A malicious DNS server can exploit this via a response with a specially crafted TCP payload to trick systemd-resolved into allocating a buffer that's too small, leading to arbitrary data being written beyond its end.
- CVE-2016-10156High
A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd timers features, allowing local attackers to escalate their privileges to root.
- CVE-2021-3997Medium
A flaw was found in systemd where uncontrolled recursion in systemd-tmpfiles may lead to a denial of service at boot time when too many nested directories are created in /tmp.
- CVE-2019-3843High
A vulnerability was found in systemd where a service using the DynamicUser property can create a SUID/SGID binary that remains executable with the transient service UID/GID even after the service terminates. A local attacker could exploit this to access resources owned by a potentially different UID/GID.
- CVE-2019-3844High
It was discovered that a systemd service using the DynamicUser property can gain new privileges through the execution of SUID binaries, allowing creation of binaries owned by the service's transient group with the setgid bit set. A local attacker may exploit this flaw to access resources that will be.
- CVE-2022-4415Medium
A vulnerability in systemd causes systemd-coredump to ignore the kernel's fs.suid_dumpable setting, potentially leading to a local information leak.
- CVE-2026-40225Medium
In udev in systemd before version 260, local root execution can occur via malicious hardware devices and unsanitized kernel output.
- CVE-2026-40226Medium
In systemd versions 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file in nspawn.
- CVE-2015-7510Critical
There is a stack-based buffer overflow in the getpwnam and getgrnam functions of the NSS module nss-mymachines in systemd.
Original NVD description (English source)
A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process. A SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS