CVE-2025-4598
📋 TL;DR
This vulnerability in systemd-coredump allows attackers to exploit a race condition to access privileged process coredumps. By forcing a SUID process to crash and replacing it before systemd-coredump analyzes it, attackers can read sensitive data like /etc/shadow from memory. This affects Linux systems using systemd-coredump with SUID binaries.
💻 Affected Systems
- systemd-coredump
📦 What is this software?
Linux by Oracle
Linux by Oracle
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Systemd by Systemd Project
Systemd by Systemd Project
Systemd by Systemd Project
Systemd by Systemd Project
Systemd by Systemd Project
Systemd by Systemd Project
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains root-level access to sensitive system files like /etc/shadow, potentially leading to full system compromise and credential theft.
Likely Case
Local attacker reads privileged memory contents, potentially exposing sensitive configuration files or credentials loaded by SUID processes.
If Mitigated
With proper patching and security controls, impact is limited to denial of service from forced crashes.
🎯 Exploit Status
Exploitation requires winning a race condition and local shell access. No public exploit code identified in references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check specific distribution advisories (RHEL 8: RHSA-2025:22660, RHEL 9: RHSA-2025:22868, etc.)
Vendor Advisory: https://access.redhat.com/errata/RHSA-2025:22660
Restart Required: Yes
Instructions:
1. Update systemd package using your distribution's package manager. 2. For RHEL/CentOS: 'sudo yum update systemd'. 3. For Ubuntu/Debian: 'sudo apt update && sudo apt upgrade systemd'. 4. Restart affected services or reboot system.
🔧 Temporary Workarounds
Disable systemd-coredump
linuxTemporarily disable coredump collection to prevent exploitation
sudo systemctl stop systemd-coredump
sudo systemctl disable systemd-coredump
sudo systemctl mask systemd-coredump
Limit coredump size
linuxSet coredump size to 0 to prevent coredump file creation
echo 'Storage=none' | sudo tee -a /etc/systemd/coredump.conf
echo 'ProcessSizeMax=0' | sudo tee -a /etc/systemd/coredump.conf
sudo systemctl restart systemd-coredump
🧯 If You Can't Patch
- Implement strict access controls to limit who can execute SUID binaries
- Monitor for abnormal process crashes and coredump file access patterns
🔍 How to Verify
Check if Vulnerable:
Check systemd version: 'systemctl --version' and compare against patched versions in vendor advisoriesCheck Version:
systemctl --version | head -1Verify Fix Applied:
Verify systemd package version after update: 'rpm -q systemd' (RHEL) or 'dpkg -l systemd' (Debian/Ubuntu)📡 Detection & Monitoring
Log Indicators:
- Multiple SUID process crashes in short timeframes
- Unauthorized access to /var/lib/systemd/coredump/
- Abnormal coredump file creation patterns
Network Indicators:
- None - this is a local attack
SIEM Query:
source="systemd-coredump" AND (event="Process.*coredump" OR event="Core.*dumped") | stats count by pid,user | where count > threshold🔗 References
- https://access.redhat.com/errata/RHSA-2025:22660
- https://access.redhat.com/errata/RHSA-2025:22868
- https://access.redhat.com/errata/RHSA-2025:23227
- https://access.redhat.com/errata/RHSA-2025:23234
- https://access.redhat.com/errata/RHSA-2026:0414
- https://access.redhat.com/errata/RHSA-2026:1652
- https://access.redhat.com/security/cve/CVE-2025-4598
- https://bugzilla.redhat.com/show_bug.cgi?id=2369242
- https://www.openwall.com/lists/oss-security/2025/05/29/3
- http://seclists.org/fulldisclosure/2025/Jun/9
- http://www.openwall.com/lists/oss-security/2025/06/05/1
- http://www.openwall.com/lists/oss-security/2025/06/05/3
- http://www.openwall.com/lists/oss-security/2025/08/18/3
- https://blogs.oracle.com/linux/post/analysis-of-cve-2025-4598
- https://ciq.com/blog/the-real-danger-of-systemd-coredump-cve-2025-4598/
- https://lists.debian.org/debian-lts-announce/2025/07/msg00022.html
- https://www.openwall.com/lists/oss-security/2025/08/18/3
