CVE-2025-4598Medium· 4.7▾ TwilightPoC availableA vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensit…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 25.9 · likelihood 0.3 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Jul 31.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.7%
Exploit / PoC code exists
0.7% → 1.3%
A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process.
A SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality.
systemd < 252.37systemd >= 253, < 253.32systemd >= 254, < 254.25systemd >= 255, < 255.19systemd >= 256, < 256.14systemd >= 257, < 257.6openshift_container_platform = 4.0enterprise_linux = 7.0enterprise_linux = 8.0enterprise_linux = 9.0enterprise_linux = 10.0debian_linux = 11.0debian_linux = 12.0linux = 8linux = 9linux_kernel < 6.16Upgrade past the affected range:
systemd 257.6linux_kernel 6.16Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2023-26604High· 7.8systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the "systemctl status" command may be executed
CVE-2020-1712High· 7.8A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages
CVE-2023-7008Medium· 5.9A vulnerability was found in systemd-resolved
CVE-2022-45873Medium· 5.5systemd 250 and 251 allows local users to achieve a systemd-coredump deadlock by triggering a crash that has a long backtrace
CVE-2022-3821Medium· 5.5An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c
CVE-2021-33910Medium· 5.5basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdupa and alloca for a pathname controlled by a local attacker) that results in an operating system c…