CVE-2025-4598

MEDIUM EPSS 46.1%

Published May 30, 20251y ago · Modified Jun 17, 20262w ago

4.7 CVSS 3.1

Medium

Published May 30, 2025 1y ago

Last Modified Jun 17, 2026 2w ago

Description

A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process. A SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality.

CVSS Details

Base Score

4.7

Exploitability

1.0

Impact

3.6

Vector string

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector Local

Attack Complexity High

Privileges Required Low

User Interaction None

Scope Unchanged

Confidentiality High

Integrity None

Availability None

Threat Intelligence

EPSS Exploit Probability

46.1% percentile

Exploit & Patch Status

Public Exploit Known

No Patch Available

Weaknesses 1

CWE-364

Affected Products 16

Vendor	Product	Version	Range
systemd_project	systemd	*	<252.37
systemd_project	systemd	*	≥253 – <253.32
systemd_project	systemd	*	≥254 – <254.25
systemd_project	systemd	*	≥255 – <255.19
systemd_project	systemd	*	≥256 – <256.14
systemd_project	systemd	*	≥257 – <257.6
redhat	openshift_container_platform	4.0	any
redhat	enterprise_linux	7.0	any
redhat	enterprise_linux	8.0	any
redhat	enterprise_linux	9.0	any
redhat	enterprise_linux	10.0	any
debian	debian_linux	11.0	any
debian	debian_linux	12.0	any
oracle	linux	8	any
oracle	linux	9	any
linux	linux_kernel	*	<6.16

References 19

seclists.org http://seclists.org/fulldisclosure/2025/Jun/9
openwall.com http://www.openwall.com/lists/oss-security/2025/06/05/1

Mailing List
openwall.com http://www.openwall.com/lists/oss-security/2025/06/05/3

Mailing List
openwall.com http://www.openwall.com/lists/oss-security/2025/08/18/3
access.redhat.com https://access.redhat.com/errata/RHSA-2025:22660
access.redhat.com https://access.redhat.com/errata/RHSA-2025:22868
access.redhat.com https://access.redhat.com/errata/RHSA-2025:23227
access.redhat.com https://access.redhat.com/errata/RHSA-2025:23234
access.redhat.com https://access.redhat.com/errata/RHSA-2026:0414
access.redhat.com https://access.redhat.com/errata/RHSA-2026:1652
access.redhat.com https://access.redhat.com/errata/RHSA-2026:18153
access.redhat.com https://access.redhat.com/security/cve/CVE-2025-4598

Vendor Advisory
blogs.oracle.com https://blogs.oracle.com/linux/post/analysis-of-cve-2025-4598

ExploitThird Party Advisory
bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2369242

Issue Tracking
cert-portal.siemens.com https://cert-portal.siemens.com/productcert/html/ssa-082556.html
ciq.com https://ciq.com/blog/the-real-danger-of-systemd-coredump-cve-2025-4598/

ExploitThird Party Advisory
lists.debian.org https://lists.debian.org/debian-lts-announce/2025/07/msg00022.html
openwall.com https://www.openwall.com/lists/oss-security/2025/05/29/3

Mailing List
openwall.com https://www.openwall.com/lists/oss-security/2025/08/18/3

Mailing ListThird Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.