Debian systemd-coredump information leak (DSA-5931-1, CVE-2025-4598): check, update, mitigate

On 29 May 2025 Debian released DSA-5931-1 for systemd on Debian 12 (bookworm). It fixes CVE-2025-4598, found by the Qualys Threat Research Unit in systemd-coredump, the optional crash-dump handler. A local user could use it to read sensitive memory, such as password hashes, from crashed privileged programs. Only machines where systemd-coredump is installed and handling core dumps are exposed.

At a glance

What the vulnerability is

When a program crashes, the kernel can hand its memory image to a helper such as systemd-coredump. Debian's advisory describes two problems in that hand-off:

• A kill-and-replace race. A local attacker could crash a SUID program and quickly replace the process with one of their own, so the dump handler treated the privileged dump as belonging to the attacker. Qualys demonstrated this against unix_chkpwd, a helper installed on most Linux systems, to read data from /etc/shadow.
• The dumpable flag was ignored. systemd-coredump did not pass %d (the kernel's per-process dumpable flag) in /proc/sys/kernel/core_pattern. An attacker could crash root daemons that fork and switch to the attacker's user ID and then read their core dumps. Qualys reports extracting secrets this way from sshd-session, sd-pam and cron.

Debian's tracker adds that a comprehensive fix also needs a kernel change that hands a pidfd to the user-mode coredump helper, which is another reason to keep the kernel package current.

Are you affected?

systemd-coredump is a separate package with priority optional, so first check whether it is installed and in use:

dpkg -l 'systemd*' | grep '^ii'
apt policy systemd-coredump
cat /proc/sys/kernel/core_pattern
cat /proc/sys/fs/suid_dumpable

If apt policy shows Installed: (none) and core_pattern does not pipe to systemd-coredump, this flaw does not apply. If it is installed, compare the installed version with the fixed one for your release.

How to update

sudo apt update
sudo apt install --only-upgrade systemd systemd-coredump libsystemd0
apt policy systemd-coredump

--only-upgrade upgrades packages that are already installed and does not install new ones, so the command is safe on machines without systemd-coredump. A normal sudo apt upgrade does the same job. The bookworm version available today is newer than the one in the advisory and contains the fix.

Restart or reboot?

systemd-coredump runs only when a process crashes, so the fixed code is used for the next crash. Because the update also replaces systemd itself and its library, a reboot at a convenient time is the simplest way to be sure every component runs the new code, and it also loads any newer kernel you have installed.

If you cannot update yet

Qualys suggests setting fs.suid_dumpable to 0 as a temporary fix. This stops SUID programs, and root daemons that drop privileges, from producing core dumps, so you lose crash dumps for those programs:

echo 'fs.suid_dumpable = 0' | sudo tee /etc/sysctl.d/90-no-suid-dumps.conf
sudo sysctl --system
cat /proc/sys/fs/suid_dumpable

Sources

• security-tracker.debian.org/tracker/DSA-5931-1
• lists.debian.org/debian-security-announce/2025/msg00095.html
• debian.org/security/2025/dsa-5931
• security-tracker.debian.org/tracker/DLA-4259-1
• security-tracker.debian.org/tracker/CVE-2025-4598
• security-tracker.debian.org/tracker/source-package/systemd
• cve.org/CVERecord?id=CVE-2025-4598
• nvd.nist.gov/vuln/detail/CVE-2025-4598
• qualys.com/2025/05/29/apport-coredump/apport-coredump.txt
• salsa.debian.org/systemd-team/systemd/-/raw/debian/252.38-1_deb12u1/debian/control
• manpages.debian.org/bookworm/systemd-coredump/systemd-coredump.8.en.html
• manpages.debian.org/bookworm/procps/sysctl.8.en.html
• manpages.debian.org/bookworm/apt/apt-get.8.en.html