CVE-2025-4598

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-4598
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-4598.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-4598
Downstream
ALSA (1)
AZL (4)
CGA (28)
CLSA (1)
DEBIAN (1)
ECHO (1)
MGASA (1)
OESA (6)
openSUSE (1)
RHSA (2)
RLSA (2)
SUSE (8)
UBUNTU (1)
Related
ALSA (1)
openSUSE (1)
SUSE (8)
Published
2025-05-30T13:13:26Z
Modified
2026-10-28T02:31:13Z
Severity
  • 4.7 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Systemd-coredump: race condition that allows a local attacker to crash a suid program and gain read access to the resulting core dump
Details

A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process.

A SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality.

Database specific 
{
    "cna_assigner":  "redhat",
    "cwe_ids":  [
        "CWE-364"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/4xxx/CVE-2025-4598.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "fixed":  "0:257-23.el10"
                        },
                        {
                            "fixed":  "0:252-55.el9_7.7"
                        },
                        {
                            "fixed":  "0:252-55.el9_7.7"
                        },
                        {
                            "fixed":  "1769512383"
                        },
                        {
                            "fixed":  "1767888970"
                        },
                        {
                            "fixed":  "1767904573"
                        },
                        {
                            "fixed":  "1.5.9-1765201856"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "InverseAffectedRanges"
                }
            ]
        },
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "fixed":  "252.37"
                        },
                        {
                            "introduced":  "253.0"
                        },
                        {
                            "fixed":  "253.32"
                        },
                        {
                            "introduced":  "254.0"
                        },
                        {
                            "fixed":  "254.25"
                        },
                        {
                            "introduced":  "255.0"
                        },
                        {
                            "fixed":  "255.19"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "StandardRange"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/systemd/systemd

Affected ranges

Type
GIT
Repo
https://github.com/systemd/systemd
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
dd4db7e0409214863ea0427eb831896cb4c66840
Fixed
00a12c234e2506f5cab683460199575f13c454db
Fixed
add060fea4071db5b3e7b18234d51fd65d4aefac
Fixed
cff89041ae69dfeef957b25797b0af5dfcf657fb
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "256.0"
                },
                {
                    "fixed":  "256.14"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "257.0"
                },
                {
                    "fixed":  "257.6"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "7"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "InverseAffectedRanges"
        },
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "8"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "InverseAffectedRanges"
        }
    ]
}

Affected versions

Other
v1
v2
v3
v4
v5
v6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-4598.json"