CVE-2025-4598: systemd — Exploit & Fix

Description

A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process. A SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality.

Is your site exposed to CVE-2025-4598?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

4.7

MEDIUM

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness Type (CWE)

CWE-364 CWE-364

Affected Products

Vendor	Product	Versions
systemd_project	systemd	< 252.37
systemd_project	systemd	253 — 253.32
systemd_project	systemd	254 — 254.25
systemd_project	systemd	255 — 255.19
systemd_project	systemd	256 — 256.14
systemd_project	systemd	257 — 257.6
redhat	openshift_container_platform	All
redhat	enterprise_linux	All
redhat	enterprise_linux	All
redhat	enterprise_linux	All
redhat	enterprise_linux	All
debian	debian_linux	All
debian	debian_linux	All
oracle	linux	All
oracle	linux	All
linux	linux_kernel	< 6.16

References

Advisories & Patches

https://access.redhat.com/security/cve/CVE-2025-4598

Exploits

https://blogs.oracle.com/linux/post/analysis-of-cve-2025-4598 https://ciq.com/blog/the-real-danger-of-systemd-coredump-cve-2025-4598/

Other References

https://access.redhat.com/errata/RHSA-2025:22660 https://access.redhat.com/errata/RHSA-2025:22868 https://access.redhat.com/errata/RHSA-2025:23227 https://access.redhat.com/errata/RHSA-2025:23234 https://access.redhat.com/errata/RHSA-2026:0414 https://access.redhat.com/errata/RHSA-2026:1652 https://bugzilla.redhat.com/show_bug.cgi?id=2369242 https://www.openwall.com/lists/oss-security/2025/05/29/3 http://seclists.org/fulldisclosure/2025/Jun/9 http://www.openwall.com/lists/oss-security/2025/06/05/1

Frequently Asked Questions

What is CVE-2025-4598? +

A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process. A SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality. It has a CVSS v3.1 base score of 4.7 (MEDIUM).

How severe is CVE-2025-4598? +

CVE-2025-4598 has a CVSS v3.1 score of 4.7 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2025-4598? +

CVE-2025-4598 affects products from debian, linux, oracle, redhat, systemd_project, specifically: debian_linux, enterprise_linux, linux, linux_kernel, openshift_container_platform, systemd. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-4598? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-6387 8.1

A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to …

CVE-2024-7589 8.1

A signal handler in sshd(8) may call a logging function that is not async-signal-safe. The signal handler is invoked when …

CVE-2026-24792 8.1

in OpenHarmony v6.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps.

CVE-2026-53185 7.8

In the Linux kernel, the following vulnerability has been resolved: zram: fix use-after-free in zram_bvec_write_partial() zram_read_page() picks the sync or …

CVE-2024-6409 7.0

A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a remote attacker does …

CVE-2025-53092 6.5

Strapi is an open source headless content management system. Strapi versions prior to 5.20.0 contain a CORS misconfiguration vulnerability in …

CVE-2025-4598