Vulnerability

CERT-In Vulnerability Note CIVN-2025-0121
Multiple Information Disclosure Vulnerabilities in Linux (Apport and systemd-coredump)

Original Issue Date:June 12, 2025

Severity Rating: MEDIUM

Software Affected

Red Hat Enterprise Linux versions 9 and 10,
Fedora versions 40 and 41
Ubuntu versions 16.04 to 24.04, Apport versions up to 2.32.0

Overview

Multiple Information Disclosure vulnerabilities have been reported in Linux systems which could allow a local attacker to modify or access sensitive information potentially leading to privilege escalation on the targeted system.

Target Audience:
All end-user organizations and individuals using Linux systems

Risk Assessment:
Modify or access sensitive files potentially leading to privilege escalation

Impact Assessment:
Linux systems using Apport (Ubuntu) and systemd-coredump (RHEL, Fedora) are affected by these vulnerabilities.

Description

Apport and systemd-coredump are designed to handle crash reporting and core dumps in Linux systems (Ubuntu, Fedora, Redhat). System-coredump automatically captures snapshots of a process�s memory whenever a program crashes. Apport is Ubuntu�s built in crash reporting framework. It gathers relevant details like stack traces, log files, package information and bundles them into a report for developers to analyze.

Multiple Information Disclosure vulnerabilities exist in Linux systems due to a race condition that allows a local attacker to crash a SUID process (a program that runs with special permissions) and replace it with a non-SUID binary and through PID-reuse by leveraging namespaces on the targeted system.

Successful exploitation of these vulnerabilities could allow an attacker to modify or access sensitive information (such as password hashes from the /etc/shadow file) potentially leading to privilege escalation on the targeted system.

Solution

Apply appropriate updates as mentioned in:
https://blog.qualys.com/vulnerabilities-threat-research/2025/05/29/qualys-tru-discovers-two-local-information-disclosure-vulnerabilities-in-apport-and-systemd-coredump-cve-2025-5054-and-cve-2025-4598

Vendor Information

Linux
https://ubuntu.com/blog/apport-local-information-disclosure-vulnerability-fixes-available

References

Qualys Threat Research Unit (TRU)
https://blog.qualys.com/vulnerabilities-threat-research/2025/05/29/qualys-tru-discovers-two-local-information-disclosure-vulnerabilities-in-apport-and-systemd-coredump-cve-2025-5054-and-cve-2025-4598

CVE Name
CVE-2025-4598
CVE-2025-5054

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India