CVE-2025-4598 Race condition in Red Hat Ceph Storage 7

What is CVE-2025-4598?

CVE-2025-4598 is a medium-severity vulnerability in Debian Debian Linux, published on 30 May 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process.

A SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality.

Weakness: CWE-364

Which versions are affected by CVE-2025-4598?

It affects 6 products.

Products include Debian Debian Linux, Linux kernel, Oracle Linux, Redhat Enterprise Linux, Redhat Openshift Container Platform, Systemd Project Systemd.

How do I fix CVE-2025-4598?

Apply the vendor's patch.

Is CVE-2025-4598 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-4598 exists.

Other vulnerabilities in Debian Debian Linux

• CVE-2015-3306 ProFTPD Improper Access Control Exploited Critical 10.0
• CVE-2025-49113 RoundCube Webmail Deserialization of Untrusted Data Exploited Critical 9.9
• CVE-2026-24061 GNU InetUtils Argument Injection Exploited Critical 9.8
• CVE-2025-39682 Linux Kernel Improper Check for Unusual or Exceptional Conditions Exploited Critical 9.8
• CVE-2024-9680 Mozilla Firefox Use-After-Free Exploited Critical 9.8

All Debian Debian Linux vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALSA-2025:22660, AZL-64289, AZL-64292, AZL-66702, AZL-66704, CLSA-2025-1766079368 and 26 more.