A vulnerability was found in systemd-coredump that allows an attacker to force a SUID process to crash and replace it with a non-SUID binary. This enables the attacker to access the original’s privileged process coredump, potentially exposing sensitive data such as /etc/shadow content. The flaw exploits a race condition, allowing access to the original SUID process’s coredump file, which can compromise data confidentiality.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.7 | CVE-2025-4598 |
Exploitation
To exploit this vulnerability, an attacker must have low privileges and be able to execute a SUID process. By forcing the process to crash and manipulating the Linux kernel to recycle the process PID before systemd-coredump can analyze the coredump, the attacker can gain access to sensitive data stored in memory by the original process.
Affected Products
- systemd-coredump: A component of the systemd suite that handles core dumps for crashed processes.
Mitigation
To mitigate this vulnerability, it is recommended to apply the latest security patches provided by Red Hat. Additionally, restricting the use of SUID binaries and monitoring for unusual process behavior can help reduce the risk of exploitation.