Two new security vulnerabilities in popular Linux distributions—Ubuntu, Red Hat Enterprise Linux (RHEL), and Fedora—could allow attackers to access sensitive information like password hashes. The flaws were found in tools used for handling system crashes, namely apport (used by Ubuntu) and systemd-coredump (used by RHEL and Fedora).
These vulnerabilities were reported by the Qualys Threat Research Unit (TRU) and are tracked as CVE-2025-5054 and CVE-2025-4598. Both are race condition bugs, meaning they rely on timing issues where two processes compete to perform actions in an unexpected sequence, potentially leading to a security breach.
What Are the Flaws?
The main tools affected—apport and systemd-coredump—are responsible for collecting and storing system data when a crash occurs, helping developers identify and fix bugs. However, these tools can also inadvertently store sensitive data from privileged processes.
CVE-2025-5054 (CVSS Score: 4.7)
Affects the Canonical apport package (up to version 2.32.0)
Allows local attackers to exploit a race condition using PID reuse and Linux namespaces
This can result in core dumps that expose private data from Set User ID (SUID) programs
CVE-2025-4598 (CVSS Score: 4.7)
Impacts systemd-coredump used in Fedora and RHEL
Lets an attacker crash a SUID process and replace it with a non-SUID process using the same Process ID (PID)
If timed correctly, the attacker can gain access to the core dump of the original privileged process, which may include sensitive files like /etc/shadow (used for storing password hashes)
What Is SUID and Why It Matters
SUID (Set User ID) is a permission setting on Linux files that allows a user to run a file with the permissions of the file’s owner. Many system programs use SUID to perform actions that regular users are not allowed to do. If an attacker can exploit a bug in a SUID program, they might gain unauthorized access to sensitive data or even escalate privileges.
How the Exploits Work
According to Octavio Galland from Canonical, apport checks whether a crashed process is running inside a container before analyzing it. If an attacker crashes a privileged process and quickly starts a new one using the same PID inside a separate namespace, apport might mistakenly forward the core dump of the original process to the attacker’s namespace.
In a similar way, systemd-coredump can be fooled into logging the crash details of a SUID process and storing them in a way that a local attacker can read, giving access to private data in memory.
Real-World Impact
Qualys developed proof-of-concept (PoC) code showing how these bugs could be used to extract password hashes from the /etc/shadow file by crashing a system process called unix_chkpwd, which verifies user passwords. This could help attackers in offline brute-force or dictionary attacks to crack passwords.
Canonical downplayed the danger, saying the exploit mostly affects the confidentiality of the memory of SUID processes and has limited real-world impact. Still, security experts warn that core dumps can hold a treasure trove of sensitive data, including encryption keys, login tokens, and user credentials.
Risk Rating and Mitigation
Red Hat rated CVE-2025-4598 as “Moderate” due to the complexity required to successfully carry out the exploit. An attacker must win a race condition and already have local access to the system, which limits the risk.
To reduce exposure, Red Hat recommends running the following command as root:
echo 0 > /proc/sys/fs/suid_dumpable
Interesting Article : CVE-2025-47577, Critical File Upload Vulnerability Found in Wishlist WordPress Plugin
Pingback: Three Zero-Day Bugs in Qualcomm Chips Patched After Active Exploits