A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process. A SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0441 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-4598:
    A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to     crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing     the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process.

    A SUID binary or process has a special type of permission, which allows the process to run with the file     owner's permissions, regardless of the user executing the binary. This allows the process to access more     restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw     by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-     coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to     the original's SUID process coredump file. They can read sensitive content loaded into memory by the     original binary, affecting data confidentiality.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non- SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process.    A SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

According to the versions of the systemd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to     crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing     the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process.

    A SUID binary or process has a special type of permission, which allows the process to run with the file     owner's permissions, regardless of the user executing the binary. This allows the process to access more     restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw     by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-     coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to     the original's SUID process coredump file. They can read sensitive content loaded into memory by the     original binary, affecting data confidentiality.(CVE-2025-4598)

Tenable has extracted the preceding description block directly from the EulerOS systemd security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the systemd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to     crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing     the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process.A SUID     binary or process has a special type of permission, which allows the process to run with the file owner's     permissions, regardless of the user executing the binary. This allows the process to access more     restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw     by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-     coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to     the original's SUID process coredump file. They can read sensitive content loaded into memory by the     original binary, affecting data confidentiality.(CVE-2025-4598)

Tenable has extracted the preceding description block directly from the EulerOS systemd security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to     crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing     the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process. A SUID     binary or process has a special type of permission, which allows the process to run with the file owner's     permissions, regardless of the user executing the binary. This allows the process to access more     restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw     by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-     coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to     the original's SUID process coredump file. They can read sensitive content loaded into memory by the     original binary, affecting data confidentiality. (CVE-2025-4598)

  - The systemd-coredump is prone to a kill-and-replace race condition which may allow a local attacker to     gain sensitive information from crashed SUID processes. Additionally systemd-coredump does not specify %d     (the kernel's per-process dumpable flag) in /proc/sys/kernel/core_pattern allowing a local attacker to     crash root daemons that fork() and setuid() to the attacker's uid and consequently gain read access to the     resulting core dumps and therefore to sensitive information from memory of the root daemons.
    (CVE-2025-4598)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:02675-1 advisory.

    - CVE-2025-4598: Fixed race condition that allows a local attacker to crash a SUID program and gain read     access to the resulting core dump (bsc#1243935).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4259 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4259-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/          Carlos Henrique Lima Melara     July 30, 2025                                 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : systemd     Version        : 247.3-7+deb11u7     CVE ID         : CVE-2025-4598     Debian Bug     : 1106785

    The Qualys Threat Research Unit (TRU) discovered that systemd-coredump     is prone to a kill-and-replace race condition which may allow a local     attacker to gain sensitive information from crashed SUID processes.
    Additionally systemd-coredump does not specify %d (the kernel's per-     process dumpable flag) in /proc/sys/kernel/core_pattern allowing a     local attacker to crash root daemons that fork() and setuid() to the     attacker's uid and consequently gain read access to the resulting core     dumps and therefore to sensitive information from memory of the root     daemons.

    Details can be found in the Qualys advisory at     https://www.qualys.com/2025/05/29/apport-coredump/apport-coredump.txt

    For Debian 11 bullseye, this problem has been fixed in version     247.3-7+deb11u7.

    We recommend that you upgrade your systemd packages.

    For the detailed security status of systemd please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/systemd

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2025:02243-1 advisory.

    - CVE-2025-4598: Fixed race condition that allows a local attacker to crash a SUID program and gain read     access to the resulting core dump (bsc#1243935).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:02244-1 advisory.

    - CVE-2025-4598: Fixed race condition that allows a local attacker to crash a SUID program and gain read     access to the resulting core dump (bsc#1243935).

    Other bugfixes:

    - logs-show: get timestamp and boot ID only when necessary (bsc#1242827).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-99055e8fe5 advisory.

    - Fix for local information disclosure in systemd-coredump (CVE-2025-4598)
    - Fixes for systemd itself, run0, systemd-networkd, secure pager, man pages, shell completions, sd-boot,     sd-varlink
    - Hardware database update



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02019-1 advisory.

    - CVE-2025-4598: Race condition that allows a local attacker to crash a SUID program and gain read access     to the resulting core dump (bsc#1243935).
    - CVE-2023-26604: Privilege escalation via the less pager (bsc#1208958).
    - CVE-2022-4415: systemd-coredump was not respecting fs.suid_dumpable kernel setting (bsc#1205000).

    Other bugfixes:

    - clarify passno and noauto combination in /etc/fstab (bsc#1211725)
    - handle -EINTR return from bus_poll() (bsc#1215241)
    - /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the systemd package has been released.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 / 25.04 host has packages installed that are affected by a vulnerability as referenced in the USN-7559-1 advisory.

    Qualys discovered that systemd incorrectly handled metadata when processing application crashes. An     attacker could possibly use this issue to expose sensitive information.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-ba86bed822 advisory.

    - Fix for local information disclosure in systemd-coredump (CVE-2025-4598)
    - Various other fixes

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-20343 advisory.

    [239-82.0.4.5]
    - coredump: use %d in kernel core pattern - CVE-2025-4598

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5931 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5931-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     May 29, 2025                          https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : systemd     CVE ID         : CVE-2025-4598     Debian Bug     : 1106785

    The Qualys Threat Research Unit (TRU) discovered that systemd-coredump     is prone to a kill-and-replace race condition which may allow a local     attacker to gain sensitive information from crashed SUID processes.
    Additionally systemd-coredump does not specify %d (the kernel's per-     process dumpable flag) in /proc/sys/kernel/core_pattern allowing a     local attacker to crash root daemons that fork() and setuid() to the     attacker's uid and consequently gain read access to the resulting core     dumps and therefore to sensitive information from memory of the root     daemons.

    Details can be found in the Qualys advisory at     https://www.qualys.com/2025/05/29/apport-coredump/apport-coredump.txt

    For the stable distribution (bookworm), this problem has been fixed in     version 252.38-1~deb12u1.

    We recommend that you upgrade your systemd packages.

    For the detailed security status of systemd please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/systemd

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-20344 advisory.

    [252-51.0.2]
    - coredump: use %d in kernel core pattern - CVE-2025-4598

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
275990	TencentOS Server 4: systemd (TSSA-2025:0441)	Nessus	Tencent Local Security Checks	medium
503913	Siemens SIMATIC S7-1500 Signal Handler Race Condition (CVE-2025-4598)	Tenable OT Security	Tenable.ot	medium
274967	EulerOS 2.0 SP12 : systemd (EulerOS-SA-2025-2342)	Nessus	Huawei Local Security Checks	medium
274895	EulerOS 2.0 SP10 : systemd (EulerOS-SA-2025-2402)	Nessus	Huawei Local Security Checks	medium
274871	EulerOS 2.0 SP12 : systemd (EulerOS-SA-2025-2373)	Nessus	Huawei Local Security Checks	medium
274866	EulerOS 2.0 SP10 : systemd (EulerOS-SA-2025-2430)	Nessus	Huawei Local Security Checks	medium
270011	EulerOS 2.0 SP11 : systemd (EulerOS-SA-2025-2248)	Nessus	Huawei Local Security Checks	medium
270003	EulerOS 2.0 SP11 : systemd (EulerOS-SA-2025-2216)	Nessus	Huawei Local Security Checks	medium
264858	EulerOS 2.0 SP13 : systemd (EulerOS-SA-2025-2141)	Nessus	Huawei Local Security Checks	medium
264849	EulerOS 2.0 SP13 : systemd (EulerOS-SA-2025-2151)	Nessus	Huawei Local Security Checks	medium
247900	Linux Distros Unpatched Vulnerability : CVE-2025-4598	Nessus	Misc.	medium
243542	SUSE SLES15 Security Update : systemd (SUSE-SU-2025:02675-1)	Nessus	SuSE Local Security Checks	medium
243213	Debian dla-4259 : libnss-myhostname - security update	Nessus	Debian Local Security Checks	medium
241606	SUSE SLES12 Security Update : systemd (SUSE-SU-2025:02243-1)	Nessus	SuSE Local Security Checks	medium
241603	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : systemd (SUSE-SU-2025:02244-1)	Nessus	SuSE Local Security Checks	medium
241303	Fedora 42 : systemd (2025-99055e8fe5)	Nessus	Fedora Local Security Checks	medium
240826	SUSE SLES15 Security Update : systemd (SUSE-SU-2025:02019-1)	Nessus	SuSE Local Security Checks	medium
240157	Photon OS 4.0: Systemd PHSA-2025-4.0-0817	Nessus	PhotonOS Local Security Checks	medium
238067	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 / 25.04 : systemd vulnerability (USN-7559-1)	Nessus	Ubuntu Local Security Checks	medium
237702	Fedora 41 : systemd (2025-ba86bed822)	Nessus	Fedora Local Security Checks	medium
237523	Oracle Linux 8 : systemd (ELSA-2025-20343)	Nessus	Oracle Linux Local Security Checks	high
237502	Debian dsa-5931 : libnss-myhostname - security update	Nessus	Debian Local Security Checks	high
237501	Oracle Linux 9 : systemd (ELSA-2025-20344)	Nessus	Oracle Linux Local Security Checks	medium

Detections

Analytics

CVE-2025-4598

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

high

medium