New Linux Vulnerabilities Expose Password Hashes via Core Dumps
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-4598 | A vulnerability was found in systemd-coredump. A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process. A SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality. NVD description · AI analysis pending | 4.7 | <1% | PoC ×2 |
| — | |
| CVE-2025-5054 | Race condition in Canonical apport up to and including 2.32.0 allows a local attacker to leak sensitive information via PID-reuse by leveraging namespaces. Race condition in Canonical apport up to and including 2.32.0 allows a local attacker to leak sensitive information via PID-reuse by leveraging namespaces. When handling a crash, the function `_check_global_pid_and_forward`, which detects if the crashing process resided in a container, was being called before `consistency_checks`, which attempts to detect if the crashing process had been replaced. Because of this, if a process crashed and was quickly replaced with a containerized one, apport could be made to forward the core dump to the container, potentially leaking sensitive information. `consistency_checks` is now being called before `_check_global_pid_and_forward`. Additionally, given that the PID-reuse race condition cannot be reliably detected from userspace alone, crashes are only forwarded to containers if the kernel provided a pidfd, or if the crashing process was unprivileged (i.e., if dump mode == 1). NVD description · AI analysis pending | 4.7 | <1% | PoC |
| — |
Full article366 words · extracted from infosecurity-magazine.com · click to collapse
Two local information-disclosure vulnerabilities have been identified in popular Linux crash-reporting tools, allowing attackers to access sensitive system data.
The vulnerabilities, uncovered by the Qualys Threat Research Unit (TRU), impact Apport on Ubuntu and systemd-coredump on Red Hat Enterprise Linux (RHEL) and Fedora.
CVE-2025-5054 targets Apport, Ubuntu’s crash-reporting framework, while CVE-2025-4598 affects systemd-coredump, used on RHEL 9, RHEL 10 and Fedora 40/41.
Both are race-condition flaws that let local users exploit SUID programs to read core dumps from crashed processes.
In proof-of-concept demonstrations, TRU successfully extracted password hashes from /etc/shadow by targeting the unix_chkpwd utility, which is present by default on most Linux distributions.
“Crash handlers remain a hidden weak point in Linux hygiene,” said Jason Soroko, senior fellow at Sectigo.
“The discoveries tracked as CVE-2025-5054 and CVE-2025-4598 expose how engineers have placed legacy debug tools inside modern production images without redesign.”
He added that, “Core dump helpers still inherit enough privilege to reveal the entire shadow store. A local low-privilege user can wait for any SUID process to crash, then race the handler and loot hashes without tripping network detection.”
Read more on Linux security: New Linux Vulnerabilities Surge 967% in a Year
Core dumps store memory snapshots of crashing applications, often including credentials or cryptographic keys.
Tools like Apport and systemd-coredump were designed for debugging but can inadvertently expose critical data if misconfigured or left unpatched.
Affected software includes:
-
Apport up to version 2.33.0 on all Ubuntu releases since 16.04, including 24.04
-
systemd-coredump on Fedora 40/41, RHEL 9 and RHEL 10
Debian systems are not affected by default, as they do not pre-install systemd-coredump.
To reduce exposure, administrators are advised to:
-
Set /proc/sys/fs/suid_dumpable to 0 to disable core dumps for all SUID programs
-
Apply available patches as soon as possible
-
Tighten access controls around core-dump handling utilities
“Defenders should begin to treat crash management as a regulated data pipeline instead of a developer convenience,” Soroko said.
“Encrypt memory dumps in flight and at rest and enforce rapid shredding once triage ends. Strip SUID binaries of the ability to write dumps and verify handler identity with strict PID checks. These changes will end up costing little compared with a breach triggered by password hash theft.”
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/linux-vulnerabilities-expose/