A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process. A SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-ba86bed822 advisory.

    - Fix for local information disclosure in systemd-coredump (CVE-2025-4598)
    - Various other fixes

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-20343 advisory.

    [239-82.0.4.5]
    - coredump: use %d in kernel core pattern - CVE-2025-4598

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5931 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5931-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     May 29, 2025                          https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : systemd     CVE ID         : CVE-2025-4598     Debian Bug     : 1106785

    The Qualys Threat Research Unit (TRU) discovered that systemd-coredump     is prone to a kill-and-replace race condition which may allow a local     attacker to gain sensitive information from crashed SUID processes.
    Additionally systemd-coredump does not specify %d (the kernel's per-     process dumpable flag) in /proc/sys/kernel/core_pattern allowing a     local attacker to crash root daemons that fork() and setuid() to the     attacker's uid and consequently gain read access to the resulting core     dumps and therefore to sensitive information from memory of the root     daemons.

    Details can be found in the Qualys advisory at     https://www.qualys.com/2025/05/29/apport-coredump/apport-coredump.txt

    For the stable distribution (bookworm), this problem has been fixed in     version 252.38-1~deb12u1.

    We recommend that you upgrade your systemd packages.

    For the detailed security status of systemd please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/systemd

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-20344 advisory.

    [252-51.0.2]
    - coredump: use %d in kernel core pattern - CVE-2025-4598

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
237702	Fedora 41 : systemd (2025-ba86bed822)	Nessus	Fedora Local Security Checks	medium
237523	Oracle Linux 8 : systemd (ELSA-2025-20343)	Nessus	Oracle Linux Local Security Checks	high
237502	Debian dsa-5931 : libnss-myhostname - security update	Nessus	Debian Local Security Checks	high
237501	Oracle Linux 9 : systemd (ELSA-2025-20344)	Nessus	Oracle Linux Local Security Checks	high

Detections

Analytics

CVE-2025-4598

medium

Tenable Plugins

medium

high

high

high