Systemd-coredump: race condition that allows a local attacker to crash a suid program and…
Priority MEDIUM 55CWE-364Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 8 fixed, 3 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.
Summary
A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process. A SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01277 70th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Partial systemd-coredump: 252.37, 253.32, 254.25 +3Red Hat: 7 advisoriesRed Hat: 8 fixed, 3 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | systemd-coredump | before 252.37; 253.0 to before 253.32; 254.0 to before 254.25; 255.0 to before 255.19; 256.0 to before 256.14; 257.0 to before 257.6 | 252.37, 253.32, 254.25, 255.19, 256.14, 257.6 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 10 | — | 257-23.el10 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 252-55.el9_7.7 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 252-55.el9_7.7 | Patch available | CNA |
| Red Hat | Red Hat Ceph Storage 7 | — | 7 | Patch available | CNA |
| Red Hat | Red Hat Ceph Storage 8 | — | 8 | Patch available | CNA |
| Red Hat | Red Hat Ceph Storage 8 | — | 1769512383 | Patch available | CNA |
| Red Hat | Red Hat Discovery 2 | — | 1767888970 | Patch available | CNA |
| Red Hat | Red Hat Discovery 2 | — | 1767904573 | Patch available | CNA |
| Red Hat | Red Hat Insights proxy 1.5 | — | 1.5.9-1765201856 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 10 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 10 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 7 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | Not affected | CNA |
- systemd-coredump Vendor— Affected before 252.37; 253.0 to before 253.32; 254.0 to before 254.25; 255.0 to before 255.19; 256.0 to before 256.14; 257.0 to before 257.6 Fixed in 252.37, 253.32, 254.25, 255.19, 256.14, 257.6 Patch available CNA
- Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in 257-23.el10 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 252-55.el9_7.7 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 252-55.el9_7.7 Patch available CNA
- Red Hat Ceph Storage 7 VendorRed Hat Affected — Fixed in 7 Patch available CNA
- Red Hat Ceph Storage 8 VendorRed Hat Affected — Fixed in 8 Patch available CNA
- Red Hat Ceph Storage 8 VendorRed Hat Affected — Fixed in 1769512383 Patch available CNA
- Red Hat Discovery 2 VendorRed Hat Affected — Fixed in 1767888970 Patch available CNA
- Red Hat Discovery 2 VendorRed Hat Affected — Fixed in 1767904573 Patch available CNA
- Red Hat Insights proxy 1.5 VendorRed Hat Affected — Fixed in 1.5.9-1765201856 Patch available CNA
- Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — Not affected CNA
CPE configurations NVD · 11
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:systemd_project:systemd:*:*:*:*:*:*:*:* | before 252.37; 253 to before 253.32; 254 to before 254.25; 255 to before 255.19; 256 to before 256.14; 257 to before 257.6 | Vulnerable | systemd |
| cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:* | 4.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Red Hat |
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:* | 12.0 | Vulnerable | Debian |
| cpe:2.3:o:oracle:linux:8:-:*:*:*:*:*:* | 8 | Vulnerable | Oracle |
| cpe:2.3:o:oracle:linux:9:-:*:*:*:*:*:* | 9 | Vulnerable | Oracle |
- cpe:2.3:a:systemd_project:systemd:*:*:*:*:*:*:*:* Versions before 252.37; 253 to before 253.32; 254 to before 254.25; 255 to before 255.19; 256 to before 256.14; 257 to before 257.6 Vulnerable ·systemd
- cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Red Hat
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:* Versions 12.0 Vulnerable ·Debian
- cpe:2.3:o:oracle:linux:8:-:*:*:*:*:*:* Versions 8 Vulnerable ·Oracle
- cpe:2.3:o:oracle:linux:9:-:*:*:*:*:*:* Versions 9 Vulnerable ·Oracle
Remediation
- Fix · CNA systemd-coredump Fixed in 252.37, 253.32, 254.25, 255.19, 256.14, 257.6
Red Hat 7 advisories
- RHSA-2026:18153 Released 2026-05-19 · Red Hat rating Moderatesystemd security update
- Red Hat Enterprise Linux AppStream (v. 10) systemd-boot-unsigned-257-23.el10, systemd-devel-257-23.el10, systemd-journal-remote-257-23.el10 +1
- Red Hat Enterprise Linux BaseOS (v. 10) systemd-257-23.el10, systemd-container-257-23.el10, systemd-libs-257-23.el10 +5
- RHSA-2026:1652 Released 2026-02-02 · Red Hat rating ImportantRed Hat Ceph Storage
- Red Hat Ceph Storage 8 registry.redhat.io/rhceph/rhceph-8-rhel9
- RHSA-2026:0414 Released 2026-01-08 · Red Hat rating ImportantA Subscription Management tool for finding and reporting Red Hat product usage
- Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
Show 4 more Red Hat advisories
- RHSA-2025:23234 Released 2025-12-16 · Red Hat rating ModerateRed Hat Ceph Storage
- Red Hat Ceph Storage 7 registry.redhat.io/rhceph/rhceph-7-rhel9
- RHSA-2025:23227 Released 2025-12-16 · Red Hat rating ImportantRed Hat Ceph Storage
- Red Hat Ceph Storage 8 registry.redhat.io/rhceph/rhceph-8-rhel9
- RHSA-2025:22868 Released 2025-12-08 · Red Hat rating ImportantInsights proxy Container Image
- Red Hat Insights proxy 1.5 registry.redhat.io/insights-proxy/insights-proxy-container-rhel9
- RHSA-2025:22660 Released 2025-12-03 · Red Hat rating Moderatesystemd security update
- Red Hat Enterprise Linux AppStream (v. 9) systemd-boot-unsigned-252-55.el9_7.7, systemd-devel-252-55.el9_7.7, systemd-journal-remote-252-55.el9_7.7 +1
- Red Hat Enterprise Linux BaseOS (v. 9) rhel-net-naming-sysattrs-252-55.el9_7.7, systemd-252-55.el9_7.7, systemd-container-252-55.el9_7.7 +6
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 7 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat Ceph Storage 7 | Fixed | RHSA-2025:23234 |
| Red Hat Ceph Storage 8 | Fixed | RHSA-2025:23227, RHSA-2026:1652 |
| Red Hat Discovery 2 | Fixed | RHSA-2026:0414 |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2026:18153 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2025:22660 |
| Red Hat Enterprise Linux BaseOS (v. 10) | Fixed | RHSA-2026:18153 |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | RHSA-2025:22660 |
| Red Hat Insights proxy 1.5 | Fixed | RHSA-2025:22868 |
Not affected: 6 products
- Red Hat Ceph Storage 7
- Red Hat Ceph Storage 8
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4
Timeline
- 2026-10-02 Threatist record created from CVE-2025-4598
- 2026-10-03 Alias added: GHSA-jx2m-wgq5-5qcj
References
Exploit 2
Advisory 9
More Red Hat Enterprise Linux vulnerabilities
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2018-10530 Code injection in [UNKNOWN] RichFaces KEVCVSS 3.1CRITICAL 9.8
- TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
- TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
- TI-2025-23530 Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf… KEVCVSS 3.1CRITICAL 9.3
- TI-2021-17490 mod_proxy SSRF KEVCVSS 3.1CRITICAL 9.0
Sources
- CVE-2025-4598 · CVE Program
- CVE-2025-4598 · NVD
- FIRST EPSS
- GHSA-jx2m-wgq5-5qcj · GitHub Advisory Database · CC BY 4.0
- CVE-2025-4598 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences