Skip to main content

Systemd CVE-2025-4598

MEDIUM
Signal Handler Race Condition (CWE-364)
2025-05-30 secalert@redhat.com
Information Disclosure Linux Debian Oracle Red Hat Debian Linux Enterprise Linux Openshift Container Platform Systemd Systemd Project
4.7
CVSS 3.1 · Vendor: redhat
View

Vulnerability Assessment

Weakness
CWE
CWE-364
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V14 - Configuration Dependency management, component inventory
Impact

CVSS score of 4.7 (MEDIUM). Attack characteristics: local attack vector, high complexity, low privileges required, no user interaction not required. Public proof-of-concept exploit code is available. EPSS exploitation probability: 0.10%.
Exploit ScenarioDerived

Successful exploitation could compromise the medium-severity affected system.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 28, 2026

A vulnerability was found in systemd-coredump. Rated medium severity (CVSS 4.7). Public exploit code available and no vendor patch available.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability is classified under CWE-364. A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process. A SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality. Affected products include: Systemd Project Systemd, Redhat Openshift Container Platform, Redhat Enterprise Linux, Debian Debian Linux, Oracle Linux.

Know when Systemd gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
SUSE MEDIUM
Red Hat 4.7 MEDIUM

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

3
Patch released
Apr 06, 2026 - 08:30 nvd
Patch available
PoC Detected
Feb 02, 2026 - 10:16 vuln.today
Public exploit code
CVE Published
May 30, 2025 - 14:15 nvd
MEDIUM 4.7

DescriptionCVE.org

A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process.

A SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality.

Executive ViewAI

Why It Matters

Organizations using A vulnerability should be aware of moderate risk from CVE-2025-4598 rated CVSS 4.7. Exploitation could compromise the security of affected deployments. Proof-of-concept code is publicly available. Organizations should apply vendor updates when available and monitor for exploitation.

Business Impact: Low
Compensating Controls

Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.

Threat Intelligence Overview

EPSS Score
0.1%
Top 72% exploitable
Exploit
POC
Public exploit code exists
Data Quality
5 sources
Confidence: Medium
NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC Yes
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
Poc
System Exposure· derived
Small
Automatable· derived
No
Human Impact
Low

Priority Score

44
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +24
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Affected Products (CPE)CVE.org

cpe:2.3:a:systemd_project:systemd:*:*:*:*:*:*:*:*
cpe:2.3:a:systemd_project:systemd:*:*:*:*:*:*:*:*
cpe:2.3:a:systemd_project:systemd:*:*:*:*:*:*:*:*
cpe:2.3:a:systemd_project:systemd:*:*:*:*:*:*:*:*
cpe:2.3:a:systemd_project:systemd:*:*:*:*:*:*:*:*
cpe:2.3:a:systemd_project:systemd:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
cpe:2.3:o:oracle:linux:8:-:*:*:*:*:*:*
cpe:2.3:o:oracle:linux:9:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

More in Systemd

View all
CVE-2015-7510 CRITICAL POC
9.8 Sep 25

Stack-based buffer overflow in the getpwnam and getgrnam functions of the NSS module nss-mymachines in systemd. Rated cr
CVE-2013-4391 HIGH POC
7.5 Oct 28

Integer overflow in the valid_user_field function in journal/journald-native.c in systemd allows remote attackers to cau
CVE-2023-26604 HIGH POC
7.8 Mar 03

systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible su
CVE-2016-10156 HIGH POC
7.8 Jan 23

A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd tim
CVE-2019-3844 HIGH POC
7.8 Apr 26

It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of

CVE-2019-3843 HIGH POC
7.8 Apr 26

It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allo
CVE-2018-15686 HIGH POC
7.8 Oct 26

A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution

CVE-2018-6954 HIGH POC
7.8 Feb 13

systemd-tmpfiles in systemd through 237 mishandles symlinks present in non-terminal path components, which allows local

CVE-2021-33910 MEDIUM POC
5.5 Jul 20

basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Val
CVE-2019-3842 HIGH POC
7.0 Apr 09

In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using t
CVE-2018-15687 HIGH POC
7.0 Oct 26

A race condition in chown_one() of systemd allows an attacker to cause systemd to set arbitrary permissions on arbitrary
CVE-2017-1000082 CRITICAL
9.8 Jul 07

systemd v233 and earlier fails to safely parse usernames starting with a numeric digit (e.g. Rated critical severity (CV

Same weakness CWE-364 – Signal Handler Race Condition

View all
CVE-2024-6387 HIGH POC
8.1
CVE-2024-6409 HIGH
7.0
CVE-2026-24792 HIGH
8.1
CVE-2026-53185 HIGH
7.8
CVE-2026-52910 HIGH
7.8
CVE-2026-42002 HIGH
7.5
CVE-2023-5676 MEDIUM
5.9
CVE-2023-1285 MEDIUM
5.9

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
Container bci/kiwi:9.24.43-16.21 Container suse/manager/5.0/x86_64/proxy-httpd:5.0.5.7.23.1 Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1 Container suse/multi-linux-manager/5.1/x86_64/proxy-httpd:5.1.0.6.27 Container suse/multi-linux-manager/5.1/x86_64/proxy-salt-broker:5.1.0.7.32 Container suse/multi-linux-manager/5.1/x86_64/server-hub-xmlrpc-api:5.1.0.6.21 Container suse/multi-linux-manager/5.1/x86_64/server:5.1.0.6.40 Image server-image Affected
Container bci/spack:0.23.1-11.13 Container containers/lmcache-vllm-openai:0.3.2-1.2 Container containers/open-webui:0.6.9-10.29 Container containers/vllm-openai:0.9.1-1.2 Container suse/manager/5.0/x86_64/proxy-ssh:5.0.5.7.23.1 Container suse/multi-linux-manager/5.1/x86_64/proxy-ssh:5.1.0.6.20 Image ai_15_6 Image proxy-salt-broker-image Image proxy-ssh-image Affected
Container containers/lmcache-lmstack-router:0.1.6-1.2 Container containers/milvus:2.4.6-7.140 Container private-registry/harbor-db:2.12.2-2.16 Container private-registry/harbor-valkey:8.0.2-2.17 Container suse/manager/5.0/x86_64/server-attestation:5.0.5.6.23.1 Container suse/manager/5.0/x86_64/server-migration-14-16:5.0.5.7.23.1 Container suse/mariadb:10.11.11-68.9 Container suse/multi-linux-manager/5.1/x86_64/server-attestation:5.1.0.6.20 Container suse/multi-linux-manager/5.1/x86_64/server-migration-14-16:5.1.0.6.27 Container suse/multi-linux-manager/5.1/x86_64/server-postgresql:5.1.2.6.13.1 Container trento/trento-wanda:1.5.0-build1.29.1 Container trento/trento-web:2.5.0-build4.52.1 Image pr_15_6 Image proxy-httpd-image Image server-attestation-image Image server-database-migration-image Image server-migration-14-16-image Image server-postgresql-image Affected
Container containers/pytorch:2.7.0-nvidia-2.27 Container suse/manager/5.0/x86_64/proxy-salt-broker:5.0.5.1.7.28.2 Container suse/multi-linux-manager/5.1/x86_64/server-saline:5.1.2.9.13.1 Image server-saline-image Affected
Container suse/hpc/warewulf4-x86_64/sle-hpc-node:15.7.20.5.1 Image SLES15-SP6-CHOST-BYOS Image SLES15-SP6-CHOST-BYOS-Aliyun Image SLES15-SP6-CHOST-BYOS-Azure Image SLES15-SP6-CHOST-BYOS-EC2 Image SLES15-SP6-CHOST-BYOS-GCE Image SLES15-SP6-CHOST-BYOS-GDC Image SLES15-SP6-CHOST-BYOS-SAP-CCloud Image SLES15-SP6-EC2-ECS-HVM Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2-ECS-HVM Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/security/cve/CVE-2025-4598 ADVISORY https://vuldb.com/vuln/310611 ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02019/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02243/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02244/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02675/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20405/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20416/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20554/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20597/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20301/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20308/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20407/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20412/ REF http://seclists.org/fulldisclosure/2025/Jun/9 REF http://www.openwall.com/lists/oss-security/2025/06/05/1 REF http://www.openwall.com/lists/oss-security/2025/06/05/3 REF http://www.openwall.com/lists/oss-security/2025/08/18/3 REF https://access.redhat.com/errata/RHSA-2025:22660 REF https://access.redhat.com/errata/RHSA-2025:22868 REF https://access.redhat.com/errata/RHSA-2025:23227 REF https://access.redhat.com/errata/RHSA-2025:23234 REF https://access.redhat.com/errata/RHSA-2026:0414 REF https://access.redhat.com/errata/RHSA-2026:1652 REF https://access.redhat.com/errata/RHSA-2026:18153 REF https://bugzilla.redhat.com/show_bug.cgi?id=2369242 REF https://cert-portal.siemens.com/productcert/html/ssa-082556.html REF https://lists.debian.org/debian-lts-announce/2025/07/msg00022.html REF https://www.openwall.com/lists/oss-security/2025/05/29/3 REF https://www.openwall.com/lists/oss-security/2025/08/18/3

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy