news
Security Bugs in Apport and systemd-coredump
-
Qualys ☛ Qualys TRU Discovers Two Local Information Disclosure Vulnerabilities in Apport and systemd-coredump: CVE-2025-5054 and CVE-2025-4598
The Qualys Threat Research Unit (TRU) has discovered two local information-disclosure vulnerabilities in Apport and systemd-coredump.
Both issues are race-condition vulnerabilities. The first (CVE-2025-5054) affects Ubuntu’s core-dump handler, Apport, and the second (CVE-2025-4598) targets systemd-coredump, which is the default core-dump handler on Red Hat Enterprise Linux 9 and the recently released 10, as well as on Fedora. These race conditions allow a local attacker to exploit a SUID program and gain read access to the resulting core dump.
Qualys TRU has developed proofs of concept (POCs) for certain operating systems for these vulnerabilities. These POCs demonstrate how a local attacker can exploit the coredump of a crashed unix_chkpwd process (designed to verify the validity of a user’s password)—installed by default on most Linux distributions—to obtain password hashes from the /etc/shadow file.
-
Neowin ☛ Ubuntu's apport affected by core dump vulnerability, here's how to patch
Ubuntu's apport has been discovered to contain a vulnerability that could put your sensitive information at risk. Here's how to patch your system.
-
Security Affairs ☛ Two Linux flaws can lead to the disclosure of sensitive data [Ed: systemd is not Linux]
Qualys warns of two information disclosure flaws in apport and systemd-coredump, the core dump handlers in Ubuntu, Red Hat Enterprise Linux, and Fedora distros.
-
Hacker News ☛ New Linux Flaws Allow Password Hash Theft via Core Dumps in Ubuntu, RHEL, Fedora
Two information disclosure flaws have been identified in apport and systemd-coredump, the core dump handlers in Ubuntu, Red Hat Enterprise Linux, and Fedora, according to the Qualys Threat Research Unit (TRU).
-
Information Security Media Group, Corporation ☛ Linux Crash Dump Flaws Expose Passwords, Encryption Keys
The vulnerability lies in the way certain Linux distributions, including older versions of Ubuntu, Red Hat, and Fedora, handle application crashes. Tools like Apport - Ubuntu - and systemd-coredump - Red Hat and Fedora - collect data when programs fail. A flaw in their design could allow attackers with local access to read core-dump crash logs. The logs may contain sensitive information such as password hashes and encryption keys, potentially giving hackers a foothold to escalate privileges or compromise other parts of the system.