Two newly disclosed vulnerabilities in popular Linux distributions could allow local attackers to access sensitive data, such as password hashes, by exploiting the way core dumps are handled. The flaws, discovered by the Qualys Threat Research Unit (TRU), impact core dump handlers in Ubuntu, Red Hat Enterprise Linux (RHEL), and Fedora.
The bugs, tracked as CVE-2025-5054 and CVE-2025-4598, affect Apport (used in Ubuntu) and systemd-coredump (used in RHEL and Fedora), and are the result of race conditions—timing-based bugs that can be exploited under specific circumstances.
How the Exploits Work
Both vulnerabilities center on how Linux systems capture and process core dumps from SUID (Set User ID) programs, which run with elevated privileges. By manipulating how and when these dumps are handled, attackers can trick the system into leaking sensitive memory content from a privileged process.
- CVE-2025-5054 (CVSS 4.7): A race condition in Ubuntu’s Apport crash handler (up to version 2.32.0) can be exploited via PID reuse in containers. If an attacker induces a crash in a privileged process and quickly starts a new process with the same PID inside a namespace, Apport might dump the original core into the namespace—leaking sensitive data in the process.
- CVE-2025-4598 (CVSS 4.7): A race condition in systemd-coredump allows an attacker to crash a privileged SUID binary and rapidly replace it with a non-privileged one. If successful, systemd-coredump may allow access to the privileged process’s memory, including sensitive files like
/etc/shadow, which contains password hashes.
Why This Matters
While both vulnerabilities are considered moderately severe—mainly due to the difficulty of reliably winning the race condition, the potential consequences are serious. Successfully exploiting these bugs could allow a local attacker with limited permissions to read high-value information.
As Saeed Abbasi, product manager at Qualys TRU, explained:
“These race conditions allow a local attacker to exploit a SUID program and gain read access to the resulting core dump.”
Who’s Affected
- Ubuntu is affected by CVE-2025-5054, but not by CVE-2025-4598.
- RHEL and Fedora are affected by CVE-2025-4598.
- Debian systems are not affected by default, as they do not install a core dump handler unless
systemd-coredumpis manually added. - Other distributions like Amazon Linux and Gentoo have issued similar advisories.
Temporary Mitigations
Red Hat has offered a mitigation for CVE-2025-4598, advising administrators to disable core dumps for SUID binaries using the following command:
bashCopyEditecho 0 > /proc/sys/fs/suid_dumpable
This action prevents the system from generating core dumps for SUID programs, which stops the exploit, but at a cost: it also blocks developers and administrators from analyzing those binaries in case of legitimate crashes.
Red Hat described the bug as moderate, citing the complexity of successful exploitation, which requires both local access and precise timing.
