Junglewise Threat Intelligence

CVE-2025-4598: systemd systemd-coredump race condition in SUID crash handling

CVE-2025-4598 · Severity: medium · CVSS 4.7 · Published 2025-05-30

Technologies: Debian Linux, Linux Kernel, Red Hat Enterprise Linux 9. Vendors: Debian, Systemd Project, Linux, Red Hat.

Executive brief

A vulnerability in the systemd component responsible for handling program crashes could allow a local user to access sensitive information. By exploiting a timing issue during a crash, an attacker can trick the system into giving them access to the memory contents of a privileged process. This could result in the exposure of sensitive system files, such as password hashes, which are normally restricted to administrative users.

Technical details

A race condition exists in systemd-coredump during the handling of SUID process crashes. An attacker can force a SUID process to crash and then rapidly recycle the process ID (PID) by launching a non-privileged binary before systemd-coredump can verify the process metadata via /proc/pid/auxv. If the attacker wins this race, systemd-coredump may associate the privileged coredump with the attacker's new unprivileged process, granting them read access to the core file. This file contains the memory state of the original SUID process, which may include sensitive data like /etc/shadow contents. Patches have been released for various systemd versions and Linux distributions.

Affected products

  • systemd project systemd-coredump up to (excluding) 252.37, 253 up to (excluding) 253.32, 254 up to (excluding) 254.25, 255 up to (excluding) 255.19, 256 up to (excluding) 256.14, 257 up to (excluding) 257.6
  • Red Hat Enterprise Linux 9 systemd-252-55.el9_7.7
  • Debian Debian Linux 11.0, 12.0
  • Linux Linux Kernel up to (excluding) 6.16

Timeline

  • 2025-05-29: disclosed: Initial disclosure by Red Hat
  • 2025-05-30: advisory: NVD publication date
  • 2025-12-03: patched: Red Hat Enterprise Linux 9 patch released

References

Related threats