LiveActive security incident?Get immediate response
CVE Record

CVE-2025-4598: Systemd-coredump: race condition that allows a local attacker to crash a suid program and gain read access to the resulting core dump

A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process. A SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality.

MediumCVSS 4.7Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

A logged-in, low-privileged attacker may exploit a timing flaw in systemd-coredump to read a crashed SUID program’s protected memory. That memory could contain highly sensitive information, including password-hash data. The attack is local, difficult to execute reliably, and affects confidentiality rather than integrity or availability.

Executive priority

Prioritize shared Linux systems, administrative jump hosts, and platforms where untrusted users or workloads can execute locally. Treat this as a targeted confidentiality risk rather than an internet-scale emergency. Patch through normal expedited maintenance, accelerating systems that process credentials or other secrets in SUID process memory.

Technical view

The flaw is a race between PID reuse and systemd-coredump examining /proc/pid/auxv. After forcing a privileged SUID process to crash, an attacker may cause its PID to be reassigned to a non-SUID process. If timing succeeds, access controls can be evaluated against the replacement process, exposing the original privileged core dump.

Likely exposure

Exposure requires a vulnerable systemd-coredump deployment, local low-privileged access, and an attackable SUID process. The bundle lists affected RHEL, Ceph, OpenShift CoreOS, Discovery, and Insights proxy components, but also contains product exceptions, duplicate records, and incomplete version ranges. Validate each installed package against its vendor advisory.

Exploitation context

CVSS 3.1 is 4.7: local access, low privileges, high complexity, no user interaction, and potentially high confidentiality impact. The bundle does not identify CISA KEV inclusion or provide evidence of active exploitation. Successful exploitation depends on winning a PID-reuse race after crashing a SUID process.

Researcher notes

CWE-364 captures the signal-handler and race-condition class. The security decision becomes unsafe because process identity may change before auxv inspection. Assessment should distinguish the systemd package, systemd-coredump configuration, vendor backports, and product-specific status. The supplied affected data is not sufficiently consistent to derive a universal fixed-version threshold.

Mitigation direction

  • Apply the update specified by the advisory covering each installed distribution, product, and package version.
  • Check current vendor guidance where the bundle provides no explicit fixed-version boundary.
  • Reduce unnecessary local account access while affected systems await remediation.
  • Review and remove unnecessary SUID permissions according to established system-hardening policy.

Validation and detection

  • Inventory systemd and systemd-coredump package versions across Linux hosts and container host operating systems.
  • Compare each package build with the applicable vendor advisory, including product-specific exceptions.
  • Confirm whether systemd-coredump handles local crashes and whether untrusted users have shell or workload access.
  • Verify updated packages are installed and complete any vendor-required restart or reboot.
  • Review core-dump storage permissions and logs for unexpected privileged-process crashes.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-364: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

Container behavior lookup

The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2025-4598 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
4.7 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
5Timeline events
3ADP providers
16Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: pocAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
4.7CVSS 3.1MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N13.6redhat

Vulnerability scoring details

Base CVSS 3.1 score

4.7Medium
CVSS 3.1 vector shape for CVE-2025-4598Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. Source timelineredhat

    Made public.

  3. Source timelineredhat

    Reported to Red Hat.

  4. CVE publishedCVE Program

    The CVE record was published.

  5. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container
siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Unknown vendorsystemd-coredumpsystemd-coredump, 0, 253.0, 254.0, 255.0, 256.0, 257.0unaffected
Red HatRed Hat Enterprise Linux 10systemd, 0:257-23.el10affected
Red HatRed Hat Enterprise Linux 9systemd, 0:252-55.el9_7.7affected
Red HatRed Hat Enterprise Linux 9systemd, 0:252-55.el9_7.7affected
Red HatRed Hat Ceph Storage 7rhceph/rhceph-7-rhel9, 7affected
Red HatRed Hat Ceph Storage 8rhceph/rhceph-8-rhel9, 8affected
Red HatRed Hat Ceph Storage 8rhceph/rhceph-8-rhel9, 1769512383affected
Red HatRed Hat Discovery 2discovery/discovery-server-rhel9, 1767888970affected
Red HatRed Hat Discovery 2discovery/discovery-ui-rhel9, 1767904573affected
Red HatRed Hat Insights proxy 1.5insights-proxy/insights-proxy-container-rhel9, 1.5.9-1765201856affected
Red HatRed Hat Enterprise Linux 10NetworkManagerunaffected
Red HatRed Hat Enterprise Linux 10rpm-ostreeunaffected
Red HatRed Hat Enterprise Linux 7NetworkManagerunaffected
Red HatRed Hat Enterprise Linux 7systemdaffected
Red HatRed Hat Enterprise Linux 8systemdaffected
Red HatRed Hat Enterprise Linux 9NetworkManagerunaffected
Red HatRed Hat OpenShift Container Platform 4openshift/ose-rhel-coreos-9affected
Red HatRed Hat OpenShift Container Platform 4systemdunaffected
Weakness

CWE details

CWE-364

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-364 · source CWE mapping

Signal Handler Race Condition

Signal Handler Race Condition represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs