Story perspectives

Critical Linux Vulnerabilities Expose Sensitive Data, Urgent Fix Needed

6/1/2025

46 3

Summary

Story summary

Two vulnerabilities in Linux core dump handlers, Apport and systemd-coredump, have been identified as CVE-2025-5054 and CVE-2025-4598.
These race-condition flaws enable local attackers to access sensitive data, including password hashes from /etc/shadow.
Qualys advises disabling core dumps for SUID programs and restricting access to affected directories as immediate actions.
The vulnerabilities underscore the importance of addressing security risks in Linux environments and implementing proactive measures.

1 of 1

Story summary

Two vulnerabilities in Linux core dump handlers, Apport and systemd-coredump, have been identified as CVE-2025-5054 and CVE-2025-4598.
These race-condition flaws enable local attackers to access sensitive data, including password hashes from /etc/shadow.
Qualys advises disabling core dumps for SUID programs and restricting access to affected directories as immediate actions.
The vulnerabilities underscore the importance of addressing security risks in Linux environments and implementing proactive measures.