A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process. A SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality.

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2025:02243-1 advisory.

    - CVE-2025-4598: Fixed race condition that allows a local attacker to crash a SUID program and gain read     access to the resulting core dump (bsc#1243935).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:02244-1 advisory.

    - CVE-2025-4598: Fixed race condition that allows a local attacker to crash a SUID program and gain read     access to the resulting core dump (bsc#1243935).

    Other bugfixes:

    - logs-show: get timestamp and boot ID only when necessary (bsc#1242827).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-99055e8fe5 advisory.

    - Fix for local information disclosure in systemd-coredump (CVE-2025-4598)
    - Fixes for systemd itself, run0, systemd-networkd, secure pager, man pages, shell completions, sd-boot,     sd-varlink
    - Hardware database update



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02019-1 advisory.

    - CVE-2025-4598: Race condition that allows a local attacker to crash a SUID program and gain read access     to the resulting core dump (bsc#1243935).
    - CVE-2023-26604: Privilege escalation via the less pager (bsc#1208958).
    - CVE-2022-4415: systemd-coredump was not respecting fs.suid_dumpable kernel setting (bsc#1205000).

    Other bugfixes:

    - clarify passno and noauto combination in /etc/fstab (bsc#1211725)
    - handle -EINTR return from bus_poll() (bsc#1215241)
    - /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the systemd package has been released.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 / 25.04 host has packages installed that are affected by a vulnerability as referenced in the USN-7559-1 advisory.

    Qualys discovered that systemd incorrectly handled metadata when processing application crashes. An     attacker could possibly use this issue to expose sensitive information.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-ba86bed822 advisory.

    - Fix for local information disclosure in systemd-coredump (CVE-2025-4598)
    - Various other fixes

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-20343 advisory.

    [239-82.0.4.5]
    - coredump: use %d in kernel core pattern - CVE-2025-4598

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5931 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5931-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     May 29, 2025                          https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : systemd     CVE ID         : CVE-2025-4598     Debian Bug     : 1106785

    The Qualys Threat Research Unit (TRU) discovered that systemd-coredump     is prone to a kill-and-replace race condition which may allow a local     attacker to gain sensitive information from crashed SUID processes.
    Additionally systemd-coredump does not specify %d (the kernel's per-     process dumpable flag) in /proc/sys/kernel/core_pattern allowing a     local attacker to crash root daemons that fork() and setuid() to the     attacker's uid and consequently gain read access to the resulting core     dumps and therefore to sensitive information from memory of the root     daemons.

    Details can be found in the Qualys advisory at     https://www.qualys.com/2025/05/29/apport-coredump/apport-coredump.txt

    For the stable distribution (bookworm), this problem has been fixed in     version 252.38-1~deb12u1.

    We recommend that you upgrade your systemd packages.

    For the detailed security status of systemd please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/systemd

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-20344 advisory.

    [252-51.0.2]
    - coredump: use %d in kernel core pattern - CVE-2025-4598

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
241606	SUSE SLES12 Security Update : systemd (SUSE-SU-2025:02243-1)	Nessus	SuSE Local Security Checks	medium
241603	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : systemd (SUSE-SU-2025:02244-1)	Nessus	SuSE Local Security Checks	medium
241303	Fedora 42 : systemd (2025-99055e8fe5)	Nessus	Fedora Local Security Checks	medium
240826	SUSE SLES15 Security Update : systemd (SUSE-SU-2025:02019-1)	Nessus	SuSE Local Security Checks	medium
240157	Photon OS 4.0: Systemd PHSA-2025-4.0-0817	Nessus	PhotonOS Local Security Checks	medium
238067	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 / 25.04 : systemd vulnerability (USN-7559-1)	Nessus	Ubuntu Local Security Checks	medium
237702	Fedora 41 : systemd (2025-ba86bed822)	Nessus	Fedora Local Security Checks	medium
237523	Oracle Linux 8 : systemd (ELSA-2025-20343)	Nessus	Oracle Linux Local Security Checks	high
237502	Debian dsa-5931 : libnss-myhostname - security update	Nessus	Debian Local Security Checks	high
237501	Oracle Linux 9 : systemd (ELSA-2025-20344)	Nessus	Oracle Linux Local Security Checks	high

Detections

Analytics

CVE-2025-4598

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

high

high

high