CVE-2025-4598

What it actually does

Race condition in systemd-coredump allows a local attacker to force a SUID process crash, win PID reuse before /proc/pid/auxv analysis completes, and obtain the privileged coredump containing sensitive in-memory data such as /etc/shadow contents.

Why it matters to the business

Attackers on the same system may obtain passwords or other secrets loaded by privileged binaries, increasing risk of lateral movement or privilege escalation; however low EPSS, high attack complexity, and absence from KEV indicate limited real-world impact even after 514 days.

How an attack unfolds

An attacker on the local system repeatedly crashes a chosen SUID binary while racing the kernel PID allocator against systemd-coredump; winning the race lets the attacker substitute a non-SUID binary so the coredump handler writes the original privileged memory image to a readable file.

How to fix it

Upgrade linux-hwe on Ubuntu Pro 16.04 LTS to 4.15.0-194.205~16.04.1 or newer; apply all subsequent kernel and systemd updates; consider disabling coredumps for SUID binaries via sysctl or systemd configuration where feasible.

How to confirm the fix worked

Confirm the installed linux-hwe package version is at least 4.15.0-194.205~16.04.1; test that deliberate SUID crashes no longer produce readable privileged coredumps for unprivileged users; review kernel and systemd changelogs for the race-condition fix.

Typical attack path

1. Identify a SUID binary that loads sensitive data into memory
2. Trigger repeated crashes of the target process
3. Win the PID-recycling race before systemd-coredump reads /proc/pid/auxv
4. Replace the crashed process with a non-SUID binary under attacker control
5. Read the resulting coredump to extract secrets such as shadow hashes

How to detect it

Search system logs for unusual patterns of SUID process crashes followed quickly by coredump file creation; monitor for processes reading coredump files they should not access; review auditd or kernel logs for PID reuse events around SUID binaries.

What your security team should do

• Prioritize patching linux-hwe to the stated fixed version on all Ubuntu 16.04 Pro systems
• Reduce coredump exposure for SUID processes via system-wide configuration changes
• Monitor EPSS trend; reassess if score rises sharply or new exploit code appears
• Audit SUID binaries and minimize their use where possible